CVE-2026-93660: SQLBot through 1.10.1 Improper Access Control via Dashboard Update
SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLBotto a version that resolves this vulnerability.Fixed in 1.10.1 - Compensating control
Restrict access to the SQLBot dashboard update endpoints (update_resource and update_canvas) so that only the owning workspace member can invoke them, preventing authenticated users from supplying arbitrary dashboard IDs to rename/overwrite dashboards of other members.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated workspace member can exploit it. The attacker does not need ownership of the target dashboard, but must be able to send requests to the affected dashboard update endpoints.
What can an attacker change?
An attacker can provide arbitrary dashboard IDs to rename another member's private dashboard and overwrite its component data, canvas styles, and view information.
Are private dashboards protected from other workspace members?
No. In affected versions through 1.10.1, the update_resource and update_canvas endpoints do not verify dashboard ownership before applying changes.