CVE-2026-120426 Details

A vulnerability exists in OpenCSG CSGHub versions through 2.6.0-ce, allowing unauthorized access to private repository files. This issue arises in the unauthenticated file resolve route, where remote attackers can read files from private model, code, or space repositories. The vulnerability is exploited by injecting a percent-encoded 'current_user' parameter into the file path, which is then forwarded to the backend with the server API key, enabling access to restricted files.

It is recommended to implement authentication checks on the resolve route to prevent anonymous access to private repositories. Additionally, ensure that the 'current_user' parameter is treated as a privileged assertion when using the server API key, and consider using a signed on-behalf-of token instead of a plain query parameter.