CVEvulnerability
CVE-2026-115322
5.3 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-10-22
- Last modified
- 2026-10-22
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-639
Description
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://github.com/bytebase/bytebase github.com
- https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/rollout_service.go#L505 github.com
- https://github.com/bytebase/bytebase/commit/bb553e8423b38c826cd7b1da5c7117080cc8705d github.com
- https://github.com/bytebase/bytebase/issues/19369 github.com
- https://github.com/bytebase/bytebase/pull/19554 github.com
- https://github.com/bytebase/bytebase/releases/tag/3.16.0 github.com
- https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-rollout-service-task-run-handlers www.vulncheck.com