Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows… (CVE-2026-115322)
Description
Bytebase versions prior to 3.16.0 have an authorization bypass vulnerability in the GetTaskRunLog, GetTaskRunSession, and PreviewTaskRunRollback functions. This flaw allows authenticated users with permission on one project to access task run data from other projects by supplying foreign task or task run UIDs. The exposed information includes execution logs, database session details, and rollback SQL statements. The vulnerability has a medium severity with a CVSS score of 4.3.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-115322 describes an authorization bypass vulnerability in Bytebase before version 3.16.0. Authenticated users authorized on a specific project can bypass access controls in the GetTaskRunLog, GetTaskRunSession, and PreviewTaskRunRollback API endpoints by providing task or task run UIDs belonging to other projects. This allows unauthorized reading of execution logs, database session information, and rollback SQL from projects to which the user should not have access. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).
Potential Impact
The vulnerability allows an authenticated user with permissions on one project to read sensitive information from other projects, including execution logs, database session details, and rollback SQL. This could lead to information disclosure but does not impact integrity or availability. The CVSS score of 4.3 reflects a medium severity impact focused on confidentiality.
Mitigation Recommendations
A fix is available in Bytebase version 3.16.0 and later. Users should upgrade to version 3.16.0 or newer to remediate this authorization bypass vulnerability. No other mitigation or workaround is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4vfr-m29p-8gpj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-115322"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ada44da4d27ba8daa6a515f
Added to database: 10/22/2026, 17:16:10 UTC
Last enriched: 10/22/2026, 17:25:41 UTC
Last updated: 10/22/2026, 17:25:41 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.