GHSA-5r3p-6rj5-7937

Source

https://github.com/advisories/GHSA-5r3p-6rj5-7937

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5r3p-6rj5-7937/GHSA-5r3p-6rj5-7937.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5r3p-6rj5-7937

Published

2026-03-02T17:32:24Z

Modified

2026-03-04T15:12:44Z

Severity

6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Bytebase vulnerable to Improper Authentication

Details

Impact

GitLab login allows login by any user.
JWT auth token can be derived as long as the server isn't rebooted.
Developers can assign issues to non-admin/DBA users.

Database specific

{
    "cwe_ids":  [
        "CWE-287"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-02T17:32:24Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/bytebase/bytebase

Package

Name: github.com/bytebase/bytebase; View open source insights on deps.dev
Purl: pkg:golang/github.com/bytebase/bytebase

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.1

Database specific

last_known_affected_version_range

"<= 1.0.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5r3p-6rj5-7937/GHSA-5r3p-6rj5-7937.json"