Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120426OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in CSGHub from OpenCSG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories.

Affected products (as reported)

Vendor	Product	Versions
OpenCSG	CSGHub	0 – through v2.6.0-ce

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/OpenCSGs/csghub/issues/1586 issue-tracking
https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/routes/router.go#L302-L303 technical-description
https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/handlers/frontend/resolve.go#L138-L151 technical-description
https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/pkg/server/backend/csghubserver/download.go#L10-L41 technical-description
https://github.com/OpenCSGs/csghub-server/blob/v2.6.0-ce/api/middleware/authenticator.go#L210-L226 technical-description
CSGHub v2.6.0-ce Release Notes release-notes
https://hackmd.io/@hieund/csghub-private-repo-file-read-idor technical-description
VulnCheck Advisory: OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route third-party-advisory