Authorization Bypass in Bytebase Affects User Access to Task Runs
CVE-2026-115322
5.3MEDIUM
What is CVE-2026-115322?
Bytebase prior to version 3.16.0 has a vulnerability where authenticated users can exploit an authorization bypass in the GetTaskRunLog, GetTaskRunSession, and PreviewTaskRunRollback functions. This loophole enables attackers with permissions on one project to manipulate task or task run UIDs to gain access to execution logs, database session information, and rollback SQL from other projects, jeopardizing the security and integrity of sensitive data across different user environments.
Affected Version(s)
bytebase 0 < 3.16.0
bytebase 3.16.0
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
lighthousekeeper1212 (Lighthouse Research Project)
leediay153 from Viettel Post