PT-2026-121359

CVE-2026-115321

Published

2026-10-22

Updated

2026-10-22

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bytebase versions prior to 3.16.0

Description An authorization bypass exists in the UpdateIssueComment handler. Low-privileged project users, including those with the Project Viewer role, can modify comments in other projects. This is achieved by setting an issue from their own project as the parent and providing a foreign comment UID to overwrite comments they are not authorized to access.

Recommendations Update Bytebase to version 3.16.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Leediay153

Lighthousekeeper1212

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key