Authorization Bypass Vulnerability in Bytebase Affects Project Users
CVE-2026-115321

5.3MEDIUM

Key Information:

Vendor

Bytebase

Status
Bytebase
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115321?

Bytebase prior to version 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler. This flaw allows users with low privileges, such as Project Viewers, to manipulate comments in different projects by using a foreign comment UID. Attackers can exploit this vulnerability to reference comments from other projects, thereby overwriting comments they shouldn't have access to. This security issue highlights significant risks in project management applications, where inadequate user role checks can lead to unauthorized data manipulation.

Affected Version(s)

bytebase 0 < 3.16.0

bytebase 3.16.0

References

https://github.com/bytebase/bytebase/issues/19369
issue-tracking
https://github.com/bytebase/bytebase/pull/19552
patchissue-tracking
https://github.com/bytebase/bytebase/commit/270e25529731b...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212 (Lighthouse Research Project)
leediay153 from Viettel Post
.