CVE-2026-115322

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bytebase/bytebase
https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/rollout_service.go#L505
https://github.com/bytebase/bytebase/commit/bb553e8423b38c826cd7b1da5c7117080cc8705d
https://github.com/bytebase/bytebase/issues/19369
https://github.com/bytebase/bytebase/pull/19554
https://github.com/bytebase/bytebase/releases/tag/3.16.0
https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-rollout-service-task-run-handlers

Configurations

No configuration.

History

22 Oct 2026, 11:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-22 11:17

Updated : 2026-10-22 17:39

NVD link : CVE-2026-115322

Mitre link : CVE-2026-115322

CVE.ORG link : CVE-2026-115322

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-115322", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "bytebase", "product": "bytebase", "versions": [{"status": "affected", "version": "0", "lessThan": "3.16.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.16.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/bytebase/bytebase", "defaultStatus": "unaffected"}]}], "published": "2026-10-22T11:17:50.967", "references": [{"url": "https://github.com/bytebase/bytebase", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/rollout_service.go#L505", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bytebase/bytebase/commit/bb553e8423b38c826cd7b1da5c7117080cc8705d", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bytebase/bytebase/issues/19369", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bytebase/bytebase/pull/19554", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bytebase/bytebase/releases/tag/3.16.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-rollout-service-task-run-handlers", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects."}], "lastModified": "2026-10-22T17:39:56.760", "sourceIdentifier": "disclosure@vulncheck.com"}