{"id":"CVE-2026-115321","kind":"vulnerability","aliases":["CVE-2026-115321"],"related":[],"title":"Bytebase: low-privilege users can overwrite comments in other projects","description":"Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.","summary":"Bytebase before 3.16.0 has an authorization bypass in its UpdateIssueComment handler. A project user can supply a foreign comment UID and overwrite comments belonging to other projects.","severity":"medium","cvss":5.3,"epss":0.00227,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bytebase","database-ops","package","self-hosted"],"not_affected_if":["bytebase-3.16.0-or-later"],"how_to_check":"- Check the installed Bytebase version; versions below `3.16.0` are affected.\n- unknown","fix":"- Upgrade Bytebase to `3.16.0` or later.","status":"open","published_at":"2026-10-22T11:17:50+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:22+00:00","updated_at":"2026-10-25T04:20:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:20:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Bytebase to `3.16.0` or later.","reach":"network","title":"Bytebase: low-privilege users can overwrite comments in other projects","impact":"medium","summary":"Bytebase before 3.16.0 has an authorization bypass in its UpdateIssueComment handler. A project user can supply a foreign comment UID and overwrite comments belonging to other projects.","category":"package","nicknames":[],"who_cares":["bytebase","self-hosted","database-ops"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker overwrites comments in other projects they cannot access","analyst_note":"","how_to_check":"- Check the installed Bytebase version; versions below `3.16.0` are affected.\n- unknown","needs_analyst":false,"not_affected_if":["bytebase-3.16.0-or-later"],"who_is_affected":"Teams that self-host Bytebase before 3.16.0 with multiple projects where some users hold low-privilege roles such as Project Viewer. Single-project deployments have less cross-project exposure. Teams already on 3.16.0 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000554,"input_tokens":3387,"output_tokens":431,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115321':14A,17A '-2026':13A,16A '3.16.0':28B,55C 'access':113C 'allow':66C 'anoth':103C 'attack':84C 'author':31B,58C 'belong':49B 'bypass':32B,59C 'bytebas':1A,18B,26B,53C 'cannot':112C 'comment':8A,44B,48B,74C,82C,106C,110C 'contain':56C 'cve':12A,15A 'databas':20B 'database-op':19B 'foreign':43B,81C 'handler':36B,64C 'host':25B 'includ':89C 'issu':98C 'low':3A,68C 'low-privileg':2A,67C 'modifi':73C 'op':21B 'overwrit':7A,47B,109C 'packag':22B 'parent':100C 'privileg':4A,69C 'project':11A,38B,52B,70C,77C,87C,90C,96C,104C 'refer':102C 'role':88C 'self':24B 'self-host':23B 'set':93C 'suppli':41B,79C 'uid':45B,83C,107C 'updateissuecom':35B,63C 'user':5A,39B,71C 'viewer':91C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Bytebase before 3.16.0 with multiple projects where some users hold low-privilege roles such as Project Viewer. Single-project deployments have less cross-project exposure. Teams already on 3.16.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115321","severity":null,"published_at":"2026-10-22T11:17:50+00:00","modified_at":"2026-10-23T15:17:27+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115321","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115321","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}