https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 14:27:52 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115321 <p>Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project&#39;s issue as parent and reference another project&#39;s comment UID to overwrite comments they cannot access.</p> <p>Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project&#39;s issue as parent and reference another project&#39;s comment UID to overwrite comments they cannot access.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115321 https://db.gcve.eu/vuln/ghsa-27j2-crf8-3w95 <p>Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project&#39;s issue as parent and reference another project&#39;s comment UID to overwrite comments they cannot access.</p> <p>Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project&#39;s issue as parent and reference another project&#39;s comment UID to overwrite comments they cannot access.</p> https://db.gcve.eu/vuln/ghsa-27j2-crf8-3w95