CVE-2026-93660

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...

CVE-2026-93660 SQLBot through 1.10.1 Improper Access Control via Dashboard Update

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...

CVE-2026-93660 SQLBot through 1.10.1 Improper Access Control via Dashboard Update

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...

EUVD-2026-82942

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...

CVE-2026-93660

SQLBot (by dataease) through version 1.10.1 has an improper access control vulnerability in the update_resource and update_canvas endpoints. The root cause is a failure to verify dashboard ownership, allowing any authenticated workspace member to supply arbitrary dashboard IDs and modify other us...

CVE-2026-93660 SQLBot through 1.10.1 Improper Access Control via Dashboard Update

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...

CVE-2026-93660: Authorization Bypass Through User-Controlled Key

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...