CVE-2026-115321
Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 22, 2026
- Updated
- Oct 23, 2026
- Reserved
- Oct 22, 2026
Description
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
bytebasebytebase |
|
References
- https://github.com/bytebase/bytebase/issues/19369issue-tracking
- https://github.com/bytebase/bytebase/pull/19552patchissue-tracking
- https://github.com/bytebase/bytebase/commit/270e25529731b59988b58f4a4b3bda431c748bc9patch
- 3.16.0 Release Notesrelease-notes
- https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/issue_service.go#L1116technical-description
- https://github.com/bytebase/bytebaseproduct
- VulnCheck Advisory: Bytebase before 3.16.0 Authorization Bypass via UpdateIssueCommentthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.