# CSGHub: an encoded parameter in a file path reads private model files

> CSGHub v2.6.0-ce exposes files in private model, code and space repositories to callers who never log in, the researcher reports.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-31
- **CVE:** CVE-2026-120426
- **CVSS:** 8.7
- **Affects:** CSGHub, csghub-server
- **Research by:** hieuPenguinnn
- **Primary source:** https://www.vulncheck.com/advisories/opencsg-csghub-through-2.6.0-ce-unauthenticated-private-repository-file-read-via-resolve-route
- **Page:** https://theinjection.dev/items/csghub-resolve-route-private-file-read/

CSGHub v2.6.0-ce and earlier let an unauthenticated caller read files from private model, code and space repositories, VulnCheck says. An encoded parameter inside the file path overrides the acting user. No fixed version is listed.

## What happened

hieuPenguinnn reported an unauthenticated private repository file read in OpenCSG's CSGHub on October 31, 2026, in a public issue on the project's GitHub repository, with a write-up on HackMD. VulnCheck published the finding as CVE-2026-120426 on November 2 and scored it 8.7. A CSGHub collaborator replied on November 1 that the team is reviewing the report and can neither confirm nor deny it yet.

## How it works

Authorization bypass through a user-controlled key is the mechanism. The CSGHub portal serves the file resolve route with no authentication guard, and for an anonymous request it fetches the file using the server-wide API key instead of a user token. On that backend call the acting identity travels as a current_user query parameter, and the portal inserts the URL's file path into the request without encoding it. A path carrying a percent-encoded query separator can therefore append its own current_user value, and the backend, seeing the service key, treats that value as the acting user.

## Who is affected

CSGHub v2.6.0-ce and earlier are the versions VulnCheck lists, and the report describes split deployments in which the portal holds a service API key. Private model, code and space repositories are reachable; dataset routes are not, because the backend requires a login for them. The researcher reviewed source code at that release tag and states that no request was executed against a live deployment.

## What to do

Require authentication in front of the portal's resolve route for non-public content until OpenCSG ships a fix, and keep CSGHub instances that hold private repositories off untrusted networks. The write-up also asks the project to stop using the service API key for user-facing file reads, to percent-encode path segments before building the backend query, and to treat a service-key current_user value as a signed assertion.

## Quick facts

- **Affected:** CSGHub v2.6.0-ce and earlier, portal and csghub-server
- **Fixed in:** No fixed version listed; v2.6.0-ce is the latest release
- **CVE:** CVE-2026-120426, assigned by VulnCheck
- **Found by:** hieuPenguinnn, per VulnCheck
- **Disclosed:** October 31, 2026 in a public GitHub issue; VulnCheck advisory November 2
- **Attack type:** Unauthenticated authorization bypass through a user-controlled current_user parameter
- **Vendor status:** OpenCSG acknowledged the report on November 1 and says it cannot yet confirm or deny it

## Questions

### Is CSGHub patched against CVE-2026-120426?

CSGHub has no fixed release for CVE-2026-120426 as of November 3, 2026. VulnCheck lists v2.6.0-ce and earlier as affected and names no fixed version, and the project's releases page shows v2.6.0-ce as the latest. OpenCSG acknowledged the report on November 1 and said it was still reviewing it, so operators have to gate the resolve route themselves.

### Which CSGHub repositories can an anonymous caller read?

Private model, code and space repositories are the ones the report covers. The researcher writes that dataset routes are not affected, because the CSGHub backend requires a login for them. Exposure applies to split deployments where the portal holds a server-wide API key, and the loss is confidentiality only: the write-up claims no write access and no code execution.

### How was the CSGHub flaw found and tested?

Static source review found the flaw. hieuPenguinnn read the portal's resolve handler, its download helper and the backend authenticator at tag v2.6.0-ce, and states that no request was executed against a live deployment. VulnCheck assigned CVE-2026-120426 with a CVSS v4.0 score of 8.7, while OpenCSG has not yet confirmed the behaviour on a running instance.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/opencsg-csghub-through-2.6.0-ce-unauthenticated-private-repository-file-read-via-resolve-route)
2. [Researcher Write-Up](https://hackmd.io/@hieund/cve-2026-120426-csghub-private-repo-file-read-idor)
3. [GitHub Issue](https://github.com/OpenCSGs/csghub/issues/1586)
4. [CSGHub Releases](https://github.com/OpenCSGs/csghub/releases)