PT-2026-121360

CVE-2026-115322

Published

2026-10-22

Updated

2026-10-22

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bytebase versions prior to 3.16.0

Description An authorization bypass allows authenticated users to access task runs from other projects by providing a UID. Users with permissions on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects via the GetTaskRunLog(), GetTaskRunSession(), and PreviewTaskRunRollback() functions.

Recommendations Update Bytebase to version 3.16.0 or later. As a temporary workaround, restrict access to the GetTaskRunLog(), GetTaskRunSession(), and PreviewTaskRunRollback() functions.

Exploitability

Exploit

Fix

Impacts

Researchers

Leediay153

Lighthousekeeper1212

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers