CVE-2026-93660

SQLBot (by dataease) through version 1.10.1 has an improper access control vulnerability in the update_resource and update_canvas endpoints. The root cause is a failure to verify dashboard ownership, allowing any authenticated workspace member to supply arbitrary dashboard IDs and modify other us...