CVEvulnerability
CVE-2026-93660
7.1 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-18
- Last modified
- 2026-09-22
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-639
Description
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://github.com/dataease/SQLBot github.com
- https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/dashboard/crud/dashboard_service.py github.com
- https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/system/schemas/permission.py github.com
- https://github.com/dataease/SQLBot/commit/fccdd29421dfc32d3a552ab29b2554974e1ebc4c github.com
- https://github.com/dataease/SQLBot/issues/1377 github.com
- https://www.vulncheck.com/advisories/sqlbot-through-1.10.1-improper-access-control-via-dashboard-update www.vulncheck.com