{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/opencsg/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opencsg:csghub:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120426"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CSGHub (\u003c= 2.6.0-ce)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","web-application","repository-exposure","cve-2026-120426"],"_cs_type":"advisory","_cs_vendors":["OpenCSG"],"content_html":"\u003cp\u003eOpenCSG CSGHub versions through 2.6.0-ce are affected by an authorization bypass vulnerability in the unauthenticated file resolve route. An unauthenticated remote attacker can exploit this by injecting a percent-encoded 'current_user' parameter into the file path. When processed, the application incorrectly forwards this parameter along with its internal server API key, causing the system to treat the request as authorized and allowing access to files within private models, code, or space repositories.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized retrieval of sensitive data contained within private repositories, including source code, model weights, and other intellectual property hosted on the CSGHub instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade CSGHub to a patched version beyond 2.6.0-ce when available.\u003c/li\u003e\n\u003cli\u003eUntil patched, inspect web server access logs for anomalous requests to file resolution endpoints containing the 'current_user' parameter.\u003c/li\u003e\n\u003cli\u003eRestrict access to CSGHub instances to internal networks or via VPN to reduce exposure to the public internet.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T15:48:27Z","date_published":"2026-11-02T15:48:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-opencsg-csghub-auth-bypass/","summary":"OpenCSG CSGHub version 2.6.0-ce and earlier contains an authorization bypass vulnerability allowing remote, unauthenticated attackers to retrieve private repository files by injecting a malicious current_user parameter.","title":"OpenCSG CSGHub: Authorization bypass via file resolve route (CVE-2026-120426)","url":"https://feed.craftedsignal.io/briefs/2026-11-opencsg-csghub-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenCSG","version":"https://jsonfeed.org/version/1.1"}