CVE-2026-61891

If you're running Eclipse Theia in browser mode, treat this as an unauthenticated arbitrary file read vulnerability regardless of the 7.5 CVSS score. The issue isn't a missing path allowlist — it's a fundamental authentication gap: the HTTP layer accepts requests and re-issues session cookies without verifying that a token is present, while the WebSocket layer properly enforces token validation during upgrade handshakes. The filesystem endpoints (`GET /file`, `GET /files/`, `PUT /files/`) perform direct URI-to-path conversion with no workspace confinement logic, and they sit behind an HTTP middleware that acts as a passthrough rather than a security gate. The Electron deployment is explicitly unaffected because it uses `ElectronSecurityToken` — this is the tell. Someone recognized the risk on one transport path and hardened it, but the HTTP path was either inherited or not audited with the same scope. That creates a deceptive situation: the codebase looks secured because token enforcement exists somewhere, but the filesystem endpoints are reachable without any authentication in browser-mode deployments. Your immediate actions: (1) verify whether your Theia instance runs in browser mode — if it does, it's vulnerable; (2) check whether you're behind a reverse proxy that might mask the direct HTTP endpoints but not the underlying attack surface; (3) prioritize patching, but understand that a patch adding only path confinement without fixing the HTTP token enforcement would leave the authentication gap open. The fix must address both the token enforcement inconsistency and the lack of path confinement. The threat model implication is straightforward: any multi-tenant cloud IDE running Theia in browser mode has unauthenticated file read across all files the backend process can access. In shared environments, this means an attacker can read secrets, keys, and credentials from other tenants' workspaces in a single request. The CVSS score doesn't capture the trivial exploitability or the blast radius in cloud-native deployments — treat this as critical in any threat model where Theia serves untrusted users.

Reviewed through automated stages and approved by a human before publication.