CVE-2026-115321
Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
bytebase bytebase
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.16.0bytebaseCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
Text from CVE List
Affected versions 2
- bytebaseaffected: all versions before 3.16.0CVE List
- bytebaseunaffected: 3.16.0CVE List
References 7
- github.com/bytebase/bytebase/pull/19552Fixvia CVE List
- github.com/bytebase/bytebase/commit/270e25529731b59988b58f4a4b3bda431c748bc9Fixvia CVE List
- github.com/bytebase/bytebase/releases/tag/3.16.0Fixvia CVE List
- vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-updateissuecommentAdvisoryvia CVE List
- github.com/bytebase/bytebase/issues/19369Referencevia CVE List
- github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/issue_service.go#L1116Referencevia CVE List
- github.com/bytebase/bytebaseReferencevia CVE List