VulnerabilityDeferred

CVE-2026-58108

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them.

LOW 1.2EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as intending. This way a user can delete all personal access tokens in the system.

CVSS 4.0: 1.2 LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-284
Source: 85b1779b-6ecd-4f52-bcc5-73eac4659dcf

References

https://github.com/Ericsson/codechecker/security/advisories/GHSA-mwpp-2jmv-26vv

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.