中
5.3
Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
CVE-2026-115322
SecPulse初出
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| bytebase | bytebase |
3.16.0 未満 |
3.16.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- advisory github.com
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- patch github.com
- report github.com
- web github.com
- web github.com