CVE-2026-93660
mediumSQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify ot…
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/dataease/SQLBot disclosure@vulncheck.com
- https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/dashboard/crud/dashboard_serv... disclosure@vulncheck.com
- https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/system/schemas/permission.py disclosure@vulncheck.com
- https://github.com/dataease/SQLBot/commit/fccdd29421dfc32d3a552ab29b2554974e1ebc4c disclosure@vulncheck.com
- https://github.com/dataease/SQLBot/issues/1377 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/sqlbot-through-1.10.1-improper-access-control-via-das... disclosure@vulncheck.com