PYSEC-2026-317
Codechecker has an authentication bypass for certain API calls
Details
### Summary Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.
### Details
The following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.
The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows: ``` [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission ``` ### Impact An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.
### Patch A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for codechecker (pip). Pin to a known-safe version or switch to an alternative.