CVE-2026-61789: bytebase dbhub: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and...

CVE-2022-51026

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLABSELFHOST endpoint. Attackers can set instanceUrl t...

CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLABSELFHOST endpoint. Attackers can set instanceUrl t...

CVE-2022-51026

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLABSELFHOST endpoint. Attackers can set instanceUrl t...

CVE-2022-51026

Bytebase versions 0.12.0 before 1.0.1 are vulnerable to an authentication bypass vulnerability. The flaw exists in the POST /api/auth/login/GITLAB_SELF_HOST endpoint because the application trusts client-supplied GitLab provider configurations. Specifically, an unauthenticated attacker can set th...

EUVD-2022-56076

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLABSELFHOST endpoint. Attackers can set instanceUrl t...

CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLABSELFHOST endpoint. Attackers can set instanceUrl t...

CVE-2026-115321

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own...

CVE-2026-115322

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to rea...

EUVD-2026-108124

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to rea...

CVE-2026-115322 Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to rea...

CVE-2026-115322

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to rea...

CVE-2026-115322 Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to rea...

CVE-2026-115322

Bytebase versions prior to 3.16.0 are vulnerable to an authorization bypass in the GetTaskRunLog, GetTaskRunSession, and PreviewTaskRunRollback functions. The root cause allows authenticated users to access task runs from other projects by supplying foreign task or task run UIDs . Impacted users ...

CVE-2026-115321 Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own...

CVE-2026-115321 Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own...

EUVD-2026-108123

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own...

CVE-2026-115321

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own...

CVE-2026-115321 Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own...

CVE-2026-115321

Bytebase versions before 3.16.0 are susceptible to an authorization bypass vulnerability within the UpdateIssueComment handler. The root cause allows low-privileged users, including those with a Project Viewer role, to overwrite comments in projects they cannot access. This is achieved by setting...