CodeChecker versions up to 6.27.3 contain an authentication bypass vulnerability in certain API calls under the Authentication endpoint. This flaw allows unauthenticated users to invoke functions such as getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission with arbitrary arguments. Exploitation enables an attacker with a CodeChecker user account to assign arbitrary permissions, effectively gaining superuser privileges. A patch addressing this issue is available in version 6.27.4.