CVE-2026-58108: CWE-284 Improper Access Control in Ericsson CodeChecker
Description
CVE-2026-58108 is an improper access control vulnerability in Ericsson CodeChecker version 6.26.0. The flaw arises because a personal access token removal query filters on columns from a different table without a proper join, causing an implicit cross join. This allows a user to delete all personal access tokens in the system instead of only their own. The vulnerability has a low CVSS score of 1.2 and no known exploits in the wild.
CVSS v4.0
Score 1.2low
Affected software
Ericsson
CodeChecker
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Ericsson CodeChecker 6.26.0, the personal access token removal query incorrectly filters tokens by applying conditions on the Session table without joining it to the PersonalAccessTokenDB table. SQLAlchemy interprets this as a cross join, which means the filter does not restrict the deletion to tokens belonging to the calling user as intended. Consequently, an authenticated user with appropriate privileges can delete all personal access tokens in the system, violating access control policies (CWE-284).
Potential Impact
An authenticated user with high privileges can delete all personal access tokens in the system, potentially disrupting access for other users. There is no indication of privilege escalation or data disclosure. The impact is limited to token deletion and is rated low severity.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to users with high privileges and monitor token management activities closely.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ERIC
- Date Reserved
- 2026-06-29T10:41:35.472Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8e90e0acd9273b4987837d
Added to database: 08/26/2026, 07:08:16 UTC
Last enriched: 09/10/2026, 11:53:12 UTC
Last updated: 10/09/2026, 18:48:21 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.