SQL Injection Vulnerability in Ericsson's CodeChecker

CVE-2026-58108

What is CVE-2026-58108?

The vulnerability allows users to execute a delete operation on all personal access tokens within the Ericsson CodeChecker system due to an improper SQL query execution. The deletion process mistakenly lacks proper constraints, potentially leading to unintended token deletions across user sessions. This design flaw arises from an implicit cross join in SQLAlchemy, meaning that the operation does not restrict deletions to the intended user's tokens, posing a significant security risk.

References