CVE-2026-115322
Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
| CWE | CWE-639 |
| Vendor | bytebase |
| Product | bytebase |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for bytebase bytebase
Be the first to know when new medium vulnerabilities affecting bytebase bytebase are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
bytebase / bytebase
0 < 3.16.0
References
github.com: https://github.com/bytebase/bytebase/issues/19369 github.com: https://github.com/bytebase/bytebase/pull/19554 github.com: https://github.com/bytebase/bytebase/commit/bb553e8423b38c826cd7b1da5c7117080cc8705d github.com: https://github.com/bytebase/bytebase/releases/tag/3.16.0 github.com: https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/rollout_service.go#L505 github.com: https://github.com/bytebase/bytebase vulncheck.com: https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-rollout-service-task-run-handlers
Credits
lighthousekeeper1212 (Lighthouse Research Project) 🔍 leediay153 from Viettel Post