Low severity · published Aug 26, 2026
CVE-2026-58108
Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
1.2
CVSS
0.3%
EPSS
No
On KEV
Description
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as intending. This way a user can delete all personal access tokens in the system.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CodeChecker · Ericsson
6.26.0 before 6.28.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58108
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58108
github.com
https://github.com/Ericsson/codechecker/security/advisories/GHSA-mwpp-2jmv-26vv
More from CodeChecker
10.0
CVE-2024-10081
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
9.8
CVE-2026-25660
Authentication bypass for certain API calls
9.0
CVE-2024-10082
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
8.2
CVE-2024-53829
Cross-Site Request Forgery in CodeChecker API
7.8
CVE-2025-40843
Buffer overflow in CodeChecker log command