Csghub
Monthly
OpenCSG CSGHub through v2.6.0-ce allows unauthenticated remote attackers to read files from private model, code, and space repositories by abusing the public file resolve route. The flaw is an authorization bypass (CWE-639) in which a percent-encoded current_user parameter injected into the file path is forwarded by the portal to the backend with the portal's server API key, causing the backend authorization check to trust the attacker-controlled identity. Published severity is CVSS 8.7 (CVSS 4.0), with assessed impact limited to high confidentiality loss; no CISA KEV entry is provided, a public technical write-up exists but working exploit code is not confirmed, and no fixed version is identified in the supplied sources.
OpenCSG CSGHub through v2.6.0-ce allows unauthenticated remote attackers to read files from private model, code, and space repositories by abusing the public file resolve route. The flaw is an authorization bypass (CWE-639) in which a percent-encoded current_user parameter injected into the file path is forwarded by the portal to the backend with the portal's server API key, causing the backend authorization check to trust the attacker-controlled identity. Published severity is CVSS 8.7 (CVSS 4.0), with assessed impact limited to high confidentiality loss; no CISA KEV entry is provided, a public technical write-up exists but working exploit code is not confirmed, and no fixed version is identified in the supplied sources.