OpenCSG - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/opencsg/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:48:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenCSG CSGHub: Authorization bypass via file resolve route (CVE-2026-120426)https://feed.craftedsignal.io/briefs/2026-11-opencsg-csghub-auth-bypass/Mon, 02 Nov 2026 15:48:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-opencsg-csghub-auth-bypass/OpenCSG CSGHub version 2.6.0-ce and earlier contains an authorization bypass vulnerability allowing remote, unauthenticated attackers to retrieve private repository files by injecting a malicious current_user parameter.OpenCSG CSGHub versions through 2.6.0-ce are affected by an authorization bypass vulnerability in the unauthenticated file resolve route. An unauthenticated remote attacker can exploit this by injecting a percent-encoded 'current_user' parameter into the file path. When processed, the application incorrectly forwards this parameter along with its internal server API key, causing the system to treat the request as authorized and allowing access to files within private models, code, or space repositories.

Impact

Successful exploitation allows for the unauthorized retrieval of sensitive data contained within private repositories, including source code, model weights, and other intellectual property hosted on the CSGHub instance.

Recommendation

  • Upgrade CSGHub to a patched version beyond 2.6.0-ce when available.
  • Until patched, inspect web server access logs for anomalous requests to file resolution endpoints containing the 'current_user' parameter.
  • Restrict access to CSGHub instances to internal networks or via VPN to reduce exposure to the public internet.
]]>highadvisoryauthorization-bypassweb-applicationrepository-exposurecve-2026-120426