CVE-2026-58108
Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as intending. This way a user can delete all personal access tokens in the system.
| CWE | CWE-284 |
| Vendor | ericsson |
| Product | codechecker |
| Published | Aug 26, 2026 |
| Last Updated | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for ericsson codechecker
Be the first to know when new unknown vulnerabilities affecting ericsson codechecker are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Ericsson / CodeChecker
6.26.0 < 6.28.3
References
Credits
Arpit Jain