CVE-2026-115321: Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bytebaseto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with a role in any Bytebase project, including the Project Viewer role, can exploit it. The attacker does not need privileges in the project containing the targeted comment.
What does an attacker need to modify a comment in another project?
The attacker needs to supply the UID of a comment in another project while setting an issue in a project where they have a role as the parent. This allows the UpdateIssueComment handler to overwrite the foreign comment.
Are Bytebase deployments before 3.16.0 affected by this issue?
Yes. The affected versions are Bytebase releases before 3.16.0.