CVE-2026-115322: Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers

Q: Does exploitation require an unauthenticated attacker or user interaction?

No. The CVSS vector indicates network-based exploitation by an authenticated attacker with low privileges, and no user interaction is required.

Q: Can an attacker modify data or disrupt service through this issue?

The supplied CVSS impact vector indicates low confidentiality impact and no integrity or availability impact. The described exposure is limited to reading information associated with task runs in other projects.

Q: What version resolves the issue?

Upgrade to Bytebase 3.16.0 or later. Versions before 3.16.0 are affected according to the provided information.

Published Oct 22, 2026

Updated

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.

Affected Software

1 affected component

Bytebase Bytebase<3.16.0

Event History

Oct 22, 2026

CVE Published

via MITRE·10:57 AM

Data Sourced

via MITRE·10:57 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an unauthenticated attacker or user interaction?

No. The CVSS vector indicates network-based exploitation by an authenticated attacker with low privileges, and no user interaction is required.

Can an attacker modify data or disrupt service through this issue?

The supplied CVSS impact vector indicates low confidentiality impact and no integrity or availability impact. The described exposure is limited to reading information associated with task runs in other projects.

What version resolves the issue?