CVE-2026-25660: fallo crítico en Ericsson CodeChecker
Authentication bypass for certain API calls
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.4%
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker.
This issue affects CodeChecker: through 6.27.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Red
Productos afectados
Ericsson · CodeCheckerCVEs relacionadas — Ericsson CodeChecker
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-10081CRITICALCVE-2024-10081EPSS 39.9%CVE-2024-10082HIGHCVE-2024-10082EPSS 0.5%CVE-2026-58107MEDIUMAuthenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRunEPSS 0.4%CVE-2026-84161MEDIUMAuthenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatisticsEPSS 0.3%CVE-2026-58108LOWPersonal access token delete filters on Session columns while deleting from PersonalAccessTokenDBEPSS 0.3%CVE-2026-84164NONEStored XSS in the static HTML report export, because json.dumps does not escape the markup characterEPSS 0.3%