CVE-2026-115321
Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
| CWE | CWE-639 |
| Vendor | bytebase |
| Product | bytebase |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for bytebase bytebase
Be the first to know when new medium vulnerabilities affecting bytebase bytebase are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
bytebase / bytebase
0 < 3.16.0
References
github.com: https://github.com/bytebase/bytebase/issues/19369 github.com: https://github.com/bytebase/bytebase/pull/19552 github.com: https://github.com/bytebase/bytebase/commit/270e25529731b59988b58f4a4b3bda431c748bc9 github.com: https://github.com/bytebase/bytebase/releases/tag/3.16.0 github.com: https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/issue_service.go#L1116 github.com: https://github.com/bytebase/bytebase vulncheck.com: https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-updateissuecomment
Credits
lighthousekeeper1212 (Lighthouse Research Project) 🔍 leediay153 from Viettel Post