CVE-2026-115322

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-115322
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115322.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-115322
Published
2026-10-22T10:57:41Z
Modified
2026-10-23T02:45:24Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
Details

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115322.json"
}
References

Affected packages

Git / github.com/bytebase/bytebase

Affected ranges

Type
GIT
Repo
https://github.com/bytebase/bytebase
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c8ccd583cc662448eb6cfd12adba3a3bd6f47ebb
Fixed
bb553e8423b38c826cd7b1da5c7117080cc8705d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.16.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "bb553e8423b38c826cd7b1da5c7117080cc8705d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "3.16.0",
            "range":  [
                {
                    "fixed":  "c8ccd583cc662448eb6cfd12adba3a3bd6f47ebb"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.2.0
0.2.1
0.3.0
0.4.0
0.4.1
0.5.0
0.6.0
0.7.0
0.7.2
0.8.0
0.8.1
0.9.0
2.*
2.10.0
2.11.0
2.11.1
2.13.0
2.14.0
2.15.0
2.17.0
2.18.0
2.19.0
2.20.0
2.21.0
2.22.3
2.4.0
2.7.0
2.8.0
2.9.0
2.9.1
3.*
3.0.0
3.0.1
3.1.0
3.1.2
3.10.0
3.10.1
3.11.0
3.11.1
3.12.0
3.12.1
3.13.0
3.14.0
3.15.0
3.3.1
3.4.1
3.5.1
3.5.2
3.6.0
3.6.1
3.6.2
3.7.0
3.7.1
3.8.0
3.8.1
3.9.0
3.9.1
3.9.2
v1.*
v1.0.0
v3.*
v3.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115322.json"