CVE-2026-115321mediumCWE-639

CVE-2026-115321: falha de média gravidade em bytebase

Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar bytebase

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
bytebase · bytebase
CVEs relacionadas — bytebase

No mesmo produto, das mais perigosas para as menos.

CVE-2022-32169MEDIUMbytebase - Improper AuthorizationEPSS 0.7%CVE-2022-32170MEDIUMbytebase - Improper AuthorizationEPSS 0.7%CVE-2022-51026CRITICALBytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted LoginEPSS 0.6%CVE-2026-115322MEDIUMBytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run HandlersEPSS 0.3%