CVE-2026-93660

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.10.2

Description Authenticated workspace members can modify private dashboards belonging to other users because the system fails to verify dashboard ownership. By supplying arbitrary dashboard IDs to the 'update resource' and 'update canvas' endpoints, an attacker can rename dashboards and overwrite component data, canvas styles, and view information.

Recommendations Update SQLBot to version 1.10.2 or later. Restrict access to the 'update resource' and 'update canvas' endpoints to minimize the risk of unauthorized modifications.