The vulnerability arises because a delete query intended to target only the calling user's token instead performs an implicit cross join and applies filters on unrelated session columns. This allows an attacker to delete every personal access token stored in the database, thereby removing all established authentication mechanisms for all users. The weakness is an authorization bypass that can lead to denial of service for everyone relying on these tokens.

The flaw affects Ericsson’s CodeChecker system. No specific version information is supplied, so any deployment of CodeChecker that includes the vulnerable delete operation is potentially impacted.

The CVSS score of 1.2 indicates a low severity, and because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the risk of widespread exploitation is currently considered low. However, the attack vector is inferred to be user-initiated: any authenticated user can trigger the deletion logic, typically via a UI or API endpoint that accepts token removal requests. Given the clear authorization gap, an attacker with regular user access can execute the flaw without additional permissions, leading to a complete wipe of personal tokens.