OpenCSG CSGHub through v2.6.0‑ce contains an authorization bypass in the Resolve route that lets an attacker supply a percent‑encoded current_user parameter. The portal forwards the value with its server API key, allowing the attacker to read arbitrary files from private model, code, or space repositories. This flaw results in a confidentiality breach of sensitive internal content and is classified as CWE‑639 – Authorization Bypass By Encoding.

The vulnerability affects the OpenCSG product CSGHub in all released versions up to and including the v2.6.0‑ce release. Users running this version are exposed to the described file‑read weakness.

The CVSS base score of 8.7 indicates a high‑severity vulnerability. No EPSS score is provided and the flaw is not listed in the CISA KEV catalog. Because the exploit does not require prior authentication and only involves crafting a special HTTP request to the Resolve endpoint, remote attackers can easily obtain private repository files if they discover or guess the target path. The lack of authentication checks and the use of server API key forwarding result in a low barrier to exploitation and a high potential impact on confidential data.