---
id: "CVE-2026-115321"
kind: "vulnerability"
aliases: ["CVE-2026-115321"]
title: "Bytebase: low-privilege users can overwrite comments in other projects"
severity: "medium"
cvss: 5.3
epss: 0.00227
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bytebase", "database-ops", "package", "self-hosted"]
not_affected_if: ["bytebase-3.16.0-or-later"]
published_at: "2026-10-22T11:17:50+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115321", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115321", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Bytebase: low-privilege users can overwrite comments in other projects

Bytebase before 3.16.0 has an authorization bypass in its UpdateIssueComment handler. A project user can supply a foreign comment UID and overwrite comments belonging to other projects.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Bytebase version; versions below `3.16.0` are affected.
- unknown

## Fix

- Upgrade Bytebase to `3.16.0` or later.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115321
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115321

## From the sources

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_