{"id":"CVE-2026-115322","kind":"vulnerability","aliases":["CVE-2026-115322"],"related":[],"title":"Bytebase: task run logs readable across projects by UID","description":"Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.","summary":"Bytebase before 3.16.0 fails to check project ownership in three task-run endpoints, GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback. A signed-in user with access to one project can read execution logs, database session details and rollback SQL from other projects by supplying their UIDs.","severity":"medium","cvss":5.3,"epss":0.00281,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bytebase","database-ops","multi-project","package","self-hosted"],"not_affected_if":["bytebase-3.16.0-or-later","single-project-instance"],"how_to_check":"- Check the installed Bytebase version; `3.16.0` or later is not affected, anything earlier is.\n- Review which users hold project-level roles in your Bytebase instance, since any of them can reach the flaw.","fix":"- Upgrade Bytebase to `3.16.0` or later.\n- Until upgraded, limit project-level access to users who are trusted across all projects.","status":"open","published_at":"2026-10-22T11:17:50+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:20:20+00:00","updated_at":"2026-10-25T04:20:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:20:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Bytebase to `3.16.0` or later.\n- Until upgraded, limit project-level access to users who are trusted across all projects.","reach":"network","title":"Bytebase: task run logs readable across projects by UID","impact":"medium","summary":"Bytebase before 3.16.0 fails to check project ownership in three task-run endpoints, GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback. A signed-in user with access to one project can read execution logs, database session details and rollback SQL from other projects by supplying their UIDs.","category":"package","nicknames":[],"who_cares":["bytebase","self-hosted","multi-project","database-ops"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads other projects' task logs, DB sessions and rollback SQL.","analyst_note":"","how_to_check":"- Check the installed Bytebase version; `3.16.0` or later is not affected, anything earlier is.\n- Review which users hold project-level roles in your Bytebase instance, since any of them can reach the flaw.","needs_analyst":false,"not_affected_if":["bytebase-3.16.0-or-later","single-project-instance"],"who_is_affected":"Self-hosted or managed Bytebase instances before 3.16.0 that have more than one project with different user groups. The attacker needs a valid account with some permission on at least one project, and must know or guess foreign task or task run UIDs. Single-project instances, or deployments where every user can see every project anyway, lose little from this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":3397,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115322':12A,15A '-2026':11A,14A '3.16.0':29B,74C 'access':51B,90C 'across':6A 'allow':86C 'attack':97C 'authent':87C 'author':77C 'bypass':78C 'bytebas':1A,16B,27B,72C 'check':32B 'contain':75C 'cve':10A,13A 'databas':18B,59B,115C 'database-op':17B 'detail':61B,117C 'endpoint':40B 'execut':57B,113C 'fail':30B 'foreign':105C 'gettaskrunlog':41B,81C 'gettaskrunsess':42B,82C 'host':26B 'log':4A,58B,114C 'multi':21B 'multi-project':20B 'one':53B,101C 'op':19B 'ownership':34B 'packag':23B 'permiss':99C 'previewtaskrunrollback':44B,84C 'project':7A,22B,33B,54B,67B,92C,102C,123C 'read':56B,112C 'readabl':5A 'rollback':63B,119C 'run':3A,39B,94C,109C 'self':25B 'self-host':24B 'session':60B,116C 'sign':47B 'signed-in':46B 'sql':64B,120C 'suppli':69B,104C 'task':2A,38B,93C,106C,108C 'task-run':37B 'three':36B 'uid':9A,71B,96C,110C 'user':49B,88C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Bytebase instances before 3.16.0 that have more than one project with different user groups. The attacker needs a valid account with some permission on at least one project, and must know or guess foreign task or task run UIDs. Single-project instances, or deployments where every user can see every project anyway, lose little from this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115322","severity":null,"published_at":"2026-10-22T11:17:50+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115322","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115322","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}