Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
CVE-2026-115321
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-115321
bytebase
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "bytebase",
"product": "bytebase",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.16.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.16.0",
"versionType": "semver"
}
],
"packageURL": "pkg:golang/github.com/bytebase/bytebase",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-115321
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #53026 · Revision 1
- Added to Heist Feed
- Publisher date