Live › vulnerability › CVE-2026-115321
Go to dashboardBytebase before 3.16.0 has an authorization bypass in its UpdateIssueComment handler. A project user can supply a foreign comment UID and overwrite comments belonging to other projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Bytebase before 3.16.0 with multiple projects where some users hold low-privilege roles such as Project Viewer. Single-project deployments have less cross-project exposure. Teams already on 3.16.0 or later are not affected.
No product ranges from the sources yet.
3.16.0 are affected.3.16.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
This page as .md · .json · in your agent: get_signal("CVE-2026-115321")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.