CVE-2026-115322 in Bytebase
Summary
by MITRE • 10/22/2026
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Bytebase versions prior to 3.16.0 represents a critical authorization bypass flaw within the application's API layer, specifically affecting endpoints responsible for retrieving task execution metadata. The affected functions include GetTaskRunLog, which retrieves logs associated with database migration or change tasks; GetTaskRunSession, which exposes details about active database sessions linked to specific tasks; and PreviewTaskRunRollback, which generates SQL statements required to reverse a completed operation. These endpoints are designed to provide operational visibility into the state of database changes, but they fail to enforce proper access control checks relative to the project context associated with the authenticated user.
The core technical flaw lies in how these API endpoints validate resource ownership and permissions. Instead of verifying that the task or task run identifier provided by the client belongs to a project for which the requesting user has explicit read privileges, the application relies solely on the validity of the Universal Identifier (UID) itself. This oversight allows an authenticated attacker who possesses access rights to one specific project to construct HTTP requests containing UIDs belonging to tasks in entirely different projects. Because the backend logic does not cross-reference the UID with a permission matrix tied to the user's current session or organizational context, it assumes that possession of a valid UUID implies authorization to view its contents.
This lack of object-level access control enables unauthorized data exfiltration across project boundaries within the same Bytebase instance. An attacker can leverage this flaw to read sensitive execution logs from other projects, potentially exposing internal debugging information, query structures, or error messages that reveal architectural details. Furthermore, by accessing task run sessions, an adversary may gather intelligence on active database connections and user identities currently interacting with production systems. The ability to preview rollback SQL for tasks in unauthorized projects is particularly dangerous as it reveals the exact data manipulation statements used during migrations, providing a blueprint for potential future attacks or allowing the attacker to understand the schema changes applied by other teams without authorization.
From an industry standard perspective, this vulnerability aligns directly with CWE-284 Improper Access Control and more specifically CWE-639 Authorization Bypass Through User-Controlled Key. The attack vector is classified under MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation requires valid authentication credentials but abuses them to access resources outside their intended scope. This scenario highlights a common pitfall in web application development where developers assume that validating an input ID is sufficient for security, neglecting the necessity of checking associated permissions against the current user's role and project affiliations.
To mitigate this vulnerability, organizations running Bytebase versions earlier than 3.16.0 should upgrade to version 3.16.0 or later immediately, as these updates include patches that enforce strict authorization checks on all task-related endpoints. Until an upgrade is feasible, administrators can implement network-level controls such as Web Application Firewalls (WAF) with custom rules designed to detect and block requests containing UIDs from projects not associated with the authenticated user's session context. Additionally, implementing rigorous logging and monitoring for unusual patterns of UID access across different project boundaries can help in early detection of exploitation attempts while permanent fixes are being deployed.