CVE-2026-58108
Received Received - Intake

SQL Injection in Personal Access Token System

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Ericsson

Description
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as intending. This way a user can delete all personal access tokens in the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-58108
EUVD
EUVD-2026-66297

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58108 is a flaw in the personal access token deletion process in Ericsson CodeChecker. The delete query incorrectly filters rows from the PersonalAccessTokenDB table using columns from the unrelated Session table. This creates an implicit cross join, causing the delete operation to remove unintended tokens instead of just the intended user's token.

Detection Guidance

Check the authentication.py file in Ericsson CodeChecker for delete queries on PersonalAccessTokenDB that filter using Session table columns. Look for implicit cross joins in SQLAlchemy queries.

Impact Analysis

This vulnerability allows a user with privileged access to delete all personal access tokens in the system, not just their own. While it requires privileged access to exploit, it could lead to denial of service or loss of access for other users if tokens are deleted without authorization.

Mitigation Strategies

Update the query in authentication.py to filter directly on PersonalAccessTokenDB columns instead of Session table columns. Ensure proper ownership validation before delete operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart