CVE-2026-58108

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-58108

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58108.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-58108

Aliases

GHSA-mwpp-2jmv-26vv

Published

2026-08-26T06:48:06.407Z

Modified

2026-09-03T03:46:33.139253379Z

Severity

1.2 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:C/RE:L CVSS Calculator

Summary

Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB

Details

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as intending. This way a user can delete all personal access tokens in the system.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58108.json",
    "cna_assigner": "ERIC",
    "cwe_ids": [
        "CWE-284"
    ]
}

References

Affected packages

Git / github.com/ericsson/codechecker

Affected ranges

Type

GIT

Repo

https://github.com/ericsson/codechecker

Events

Introduced

0bbf351e870c7056cd9cc0dc44a795c0fe805dfa

Fixed

cc251975c3dcd74f738ce3b80ae6e72b444e67a6

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "6.26.0"
        },
        {
            "fixed": "6.28.3"
        }
    ]
}

Affected versions

6.*

6.28.0-rc1

v6.*

v6.26.0

v6.27.0

v6.28.0

v6.28.1

v6.28.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58108.json"