All vulnerabilities
CVE-2022-51026GHSA-5r3p-6rj5-7937

Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login

bytebase bytebaseGoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.61%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.1Fixed versionCVE List
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 1.0.1bytebaseCVE List
  • 1.0.1github.com/bytebase/bytebase, GoOSVgo get github.com/bytebase/bytebase@v1.0.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.

Text from CVE List

Affected versions 3

  • bytebaseaffected: 0.12.0 before 1.0.1CVE List
  • bytebaseunaffected: 1.0.1CVE List
  • github.com/bytebase/bytebase, Gofrom first release, fixed in 1.0.1OSV

References 7