{"id":"CVE-2026-115321","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-115321","generatedAt":"2026-10-28T11:32:47.391Z","title":"Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID.","description":"Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.","published":"2026-10-22T11:17:51.000Z","lastModified":"2026-10-23T15:17:28.000Z","status":"Awaiting Analysis","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00284,"percentile":0.208,"date":"2026-10-27","history":[{"date":"2026-10-23","score":0.00227,"percentile":0.12696}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-22T11:17:51.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-22T11:17:50.827Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/bytebase/bytebase","source":"disclosure@vulncheck.com"},{"url":"https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/issue_service.go#L1116","source":"disclosure@vulncheck.com"},{"url":"https://github.com/bytebase/bytebase/commit/270e25529731b59988b58f4a4b3bda431c748bc9","source":"disclosure@vulncheck.com"},{"url":"https://github.com/bytebase/bytebase/issues/19369","source":"disclosure@vulncheck.com"},{"url":"https://github.com/bytebase/bytebase/pull/19552","source":"disclosure@vulncheck.com"},{"url":"https://github.com/bytebase/bytebase/releases/tag/3.16.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-updateissuecomment","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-115321","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}