CVE-2026-115322

EUVD-2026-108124
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 19.57%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
bytebasebytebase
𝑥
< 3.16.0
CNA
Common Weakness Enumeration
References
https://github.com/bytebase/bytebase
https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/rollout_service.go#L505
https://github.com/bytebase/bytebase/commit/bb553e8423b38c826cd7b1da5c7117080cc8705d
https://github.com/bytebase/bytebase/issues/19369
https://github.com/bytebase/bytebase/pull/19554
https://github.com/bytebase/bytebase/releases/tag/3.16.0
https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-rollout-service-task-run-handlers