Live › vulnerability › CVE-2026-115322
Go to dashboardBytebase before 3.16.0 fails to check project ownership in three task-run endpoints, GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback. A signed-in user with access to one project can read execution logs, database session details and rollback SQL from other projects by supplying their UIDs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Bytebase instances before 3.16.0 that have more than one project with different user groups. The attacker needs a valid account with some permission on at least one project, and must know or guess foreign task or task run UIDs. Single-project instances, or deployments where every user can see every project anyway, lose little from this flaw.
No product ranges from the sources yet.
3.16.0 or later is not affected, anything earlier is.3.16.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
This page as .md · .json · in your agent: get_signal("CVE-2026-115322")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.