CVE-2026-115321
mediumBytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comm…
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/bytebase/bytebase disclosure@vulncheck.com
- https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/issue_service.go#L1116 disclosure@vulncheck.com
- https://github.com/bytebase/bytebase/commit/270e25529731b59988b58f4a4b3bda431c748bc9 disclosure@vulncheck.com
- https://github.com/bytebase/bytebase/issues/19369 disclosure@vulncheck.com
- https://github.com/bytebase/bytebase/pull/19552 disclosure@vulncheck.com
- https://github.com/bytebase/bytebase/releases/tag/3.16.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-updat... disclosure@vulncheck.com