CVE-2026-120426
Description
A flaw was found in CSGHub. An unauthenticated remote attacker can bypass authorization controls by supplying a specially crafted file path containing an injected user parameter to the unauthenticated file resolve route. This flaw allows attackers to access and read files from private repositories, resulting in unauthorized information disclosure.
Statement
This vulnerability is rated as Important because it enables unauthenticated remote actors to expose confidential data across private repositories without requiring prior privileges or user interaction. Due to improper authorization handling in the resolve endpoint, an attacker can manipulate request routing parameters so that backend queries execute with elevated server credentials, leading to high confidentiality loss. CSGHub is not distributed or supported within Red Hat enterprise product offerings, resulting in no direct impact on standard environments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
