Medium
5.3
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment...
CVE-2026-115321
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| bytebase | bytebase |
< 3.16.0 |
3.16.0 |
Original description The description as published by the source.
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory