CVE-2026-58108: SQLAlchemy Authentication Bypass Vulnerability

CVE-2026-58108 Overview

CVE-2026-58108 is a broken access control vulnerability [CWE-284] in Ericsson CodeChecker. The personal access token (PAT) removal query selects from PersonalAccessTokenDB but applies filters against columns of the Session table without a join between them. SQLAlchemy resolves the missing relationship as an implicit cross join. As a result, the filter fails to constrain the delete operation to the caller's own token. An authenticated user can invoke the removal endpoint and delete every personal access token stored in the system.

Critical Impact
An authenticated user can delete all personal access tokens across the CodeChecker deployment, disrupting API access for every user of the server.

Affected Products

Ericsson CodeChecker
Deployments exposing the CodeChecker web API with personal access token management enabled
Multi-user CodeChecker servers using SQLAlchemy-backed persistence

Discovery Timeline

2026-08-26 - CVE-2026-58108 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-58108

Vulnerability Analysis

CodeChecker exposes an authenticated endpoint that lets users remove their own personal access tokens. The intended behavior is to delete a single row from PersonalAccessTokenDB scoped to the calling user's session identity. The implementation constructs a SQLAlchemy delete statement that targets PersonalAccessTokenDB while its WHERE clause references columns that only exist on the Session model. Because no explicit join links the two tables, SQLAlchemy emits an implicit cross join. The filter therefore evaluates against the Cartesian product and matches every row in PersonalAccessTokenDB whenever any row in Session satisfies the predicate. The delete then removes all personal access tokens, not just the caller's token.

Root Cause

The root cause is improper access control [CWE-284] introduced through an ORM query composition error. The query author assumed that filtering on Session columns would implicitly scope the delete to the current user's tokens. SQLAlchemy does not enforce that scoping without a declared join or subquery, so the authorization boundary that the code appears to express is not the boundary actually enforced by the emitted SQL.

Attack Vector

An attacker requires a valid authenticated session on the CodeChecker server with the ability to call the personal access token removal endpoint. The attacker issues a normal token-removal request. The server executes the flawed delete, wiping every personal access token in the database. See the GitHub Security Advisory GHSA-mwpp-2jmv-26vv for the maintainer's technical description.

Detection Methods for CVE-2026-58108

Indicators of Compromise

Unexpected mass deletions of rows in the PersonalAccessTokenDB table across multiple user accounts.
User reports of programmatic clients or CI pipelines suddenly failing authentication after a valid personal access token stops working.
Application logs showing a single authenticated user invoking the token removal endpoint followed by widespread token invalidation.

Detection Strategies

Enable SQL query logging on the CodeChecker database and alert on DELETE statements against PersonalAccessTokenDB that lack a bound parameter for the calling user's token identifier.
Compare row counts of PersonalAccessTokenDB before and after each token removal request; a single request should decrement the count by one.
Review web server access logs for calls to the token removal endpoint and correlate against subsequent authentication failures.

Monitoring Recommendations

Instrument the CodeChecker application to emit an audit event containing the caller identity and target token identifier for every token deletion.
Forward CodeChecker application and database logs to a centralized log platform and alert on bulk token deletion patterns.
Track authentication failure rates from API clients as a leading indicator of unauthorized token removal.

How to Mitigate CVE-2026-58108

Immediate Actions Required

Upgrade CodeChecker to the fixed release referenced in the GitHub Security Advisory GHSA-mwpp-2jmv-26vv.
Audit the PersonalAccessTokenDB table for unexpected deletions and require affected users to reissue their tokens.
Restrict network access to the CodeChecker API to trusted users while the patch is being rolled out.

Patch Information

Ericsson published the fix through GitHub Security Advisory GHSA-mwpp-2jmv-26vv. Refer to the advisory for the fixed CodeChecker version and the commit that adds the proper join between PersonalAccessTokenDB and Session in the token removal query.

Workarounds

Temporarily disable the personal access token removal endpoint at the reverse proxy layer if patching is not immediately possible.
Reduce the trusted user population on the CodeChecker server until the fixed version is deployed.
Take regular backups of the CodeChecker database so that a mass token deletion can be recovered quickly.

bash

# Example: block the token removal endpoint at an nginx reverse proxy until patched
location ~* /Authentication/removeToken {
    return 403;
}