CVE-2026-115321

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Bytebase Issue Comments

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-115321

Affected Vendors & Products

Vendor	Product	Version / Range
bytebase	bytebase	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Bytebase before version 3.16.0 has an authorization bypass flaw in the UpdateIssueComment handler. This allows users with low privileges, such as Project Viewer, to modify comments in other projects by providing a comment UID from a different project. Attackers can set their own project's issue as a parent and reference an inaccessible comment UID to overwrite it.

Impact Analysis

If you use Bytebase before 3.16.0, attackers with any project role could alter comments they are not authorized to access. This could lead to misinformation, data tampering, or unauthorized changes in issue tracking, potentially disrupting workflows or causing confusion in project management.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to sensitive data or comments, potentially violating integrity and audit requirements in GDPR and HIPAA. Unauthorized changes may lead to non-compliance with data protection and record-keeping standards.

Mitigation Strategies

Upgrade Bytebase to version 3.16.0 or later to address the authorization bypass vulnerability in the UpdateIssueComment handler.

Hi! I’m here to help you understand CVE-2026-115321. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70