CVE-2026-115321

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-115321
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115321.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-115321
Published
2026-10-22T10:57:40Z
Modified
2026-10-23T02:45:49Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
Details

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115321.json"
}
References

Affected packages

Git / github.com/bytebase/bytebase

Affected ranges

Type
GIT
Repo
https://github.com/bytebase/bytebase
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c8ccd583cc662448eb6cfd12adba3a3bd6f47ebb
Fixed
270e25529731b59988b58f4a4b3bda431c748bc9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.16.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "270e25529731b59988b58f4a4b3bda431c748bc9"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "3.16.0",
            "range":  [
                {
                    "fixed":  "c8ccd583cc662448eb6cfd12adba3a3bd6f47ebb"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.2.0
0.2.1
0.3.0
0.4.0
0.4.1
0.5.0
0.6.0
0.7.0
0.7.2
0.8.0
0.8.1
0.9.0
2.*
2.10.0
2.11.0
2.11.1
2.13.0
2.14.0
2.15.0
2.17.0
2.18.0
2.19.0
2.20.0
2.21.0
2.22.3
2.4.0
2.7.0
2.8.0
2.9.0
2.9.1
3.*
3.0.0
3.0.1
3.1.0
3.1.2
3.10.0
3.10.1
3.11.0
3.11.1
3.12.0
3.12.1
3.13.0
3.14.0
3.15.0
3.3.1
3.4.1
3.5.1
3.5.2
3.6.0
3.6.1
3.6.2
3.7.0
3.7.1
3.8.0
3.8.1
3.9.0
3.9.1
3.9.2
v1.*
v1.0.0
v3.*
v3.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115321.json"