---
id: "CVE-2026-115322"
kind: "vulnerability"
aliases: ["CVE-2026-115322"]
title: "Bytebase: task run logs readable across projects by UID"
severity: "medium"
cvss: 5.3
epss: 0.00281
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bytebase", "database-ops", "multi-project", "package", "self-hosted"]
not_affected_if: ["bytebase-3.16.0-or-later", "single-project-instance"]
published_at: "2026-10-22T11:17:50+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:20:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115322", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115322", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Bytebase: task run logs readable across projects by UID

Bytebase before 3.16.0 fails to check project ownership in three task-run endpoints, GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback. A signed-in user with access to one project can read execution logs, database session details and rollback SQL from other projects by supplying their UIDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Bytebase version; `3.16.0` or later is not affected, anything earlier is.
- Review which users hold project-level roles in your Bytebase instance, since any of them can reach the flaw.

## Fix

- Upgrade Bytebase to `3.16.0` or later.
- Until upgraded, limit project-level access to users who are trusted across all projects.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115322
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115322

## From the sources

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_