CVE-2026-25660 is an authentication bypass in Ericsson CodeChecker through version 6.27.3, rated 9.8. Some calls on the Authentication endpoint run without a login, which lets an attacker grant arbitrary permissions to an existing user. The advisory points to release 6.27.4 as the patch.
What's affected
- Product: CodeChecker, the analysis and defect database tool for the Clang Static Analyzer and Clang Tidy.
- Package: codechecker on PyPI.
- Affected: through 6.27.3.
- Fixed: 6.27.4, according to the GitHub advisory text.
How to check if you're exposed
Find the version on each server and developer machine:
pip show codechecker
CodeChecker version
Then check your server access logs for calls to the Authentication service that show an anonymous user. The advisory names getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission and removePermission as the affected functions.
What to do now
- Upgrade to CodeChecker 6.27.4 or later on every server.
- Audit the current permission list for superuser or product admin rights nobody approved.
- Search server logs for anonymous requests to the Authentication endpoint and treat any as a sign of probing.
- Place the CodeChecker server behind your VPN or SSO proxy if it is reachable more widely than it needs to be.
- Rotate any credentials stored in or used by the server if you find unexplained permission changes.
Why it matters
The record lists CWE-290, authentication bypass by spoofing, and CWE-863, incorrect authorization. In plain terms, the URL pattern for the service let certain function calls skip the login check that the rest of the API enforces.
Because the change is to permissions, the impact goes beyond one request: a person with any account could promote themselves to superuser. The advisory scopes the attacker as one holding a CodeChecker user. The record does not mark it as exploited in the wild.
How to prioritise the fix
Work out who can reach the CodeChecker server and how. In many companies it is an internal tool on a flat network, which means any user or compromised workstation on that network is a possible attacker. Place it behind SSO or a VPN if it is not already.
After the upgrade, audit permissions rather than assuming the fix reverses prior changes. List superusers and product admins, and compare them to who should have those rights. An unexplained entry is a reason to treat the server as compromised and to review the analysis results it stores for tampering.
Quick check
Does the attacker need an account?
The advisory says an attacker with a CodeChecker user can gain superuser permissions, so assume yes, but the calls themselves ran as anonymous.
Sources
Last reviewed: 19 October 2026.
