Bytebase EUVD-2026-108123

Exploitation requires an authenticated account holding any project role in at least one project - explicitly including the minimal Project Viewer role (PR:L). The attacker must control an issue in their own project to supply as the 'parent', and must reference the target comment's UID from another project in the IssueComment name. It affects Bytebase instances before 3.16.0 running the vulnerable UpdateIssueComment handler (backend/api/v1/issue_service.go), which looked up the comment by UID alone without confirming it belonged to the parent issue. Limiting factors: the attacker needs valid credentials on the instance (so not fully unauthenticated), needs to know or enumerate a foreign comment UID, and can only modify comment text - no read access, deletion, or service disruption. Multi-tenant deployments with multiple projects and low-trust viewers are the realistic exposure.

This is a genuine but moderate-severity authorization (not authentication) bypass. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 align well with the described mechanism: a network-reachable API handler (UpdateIssueComment) that trusts a user-controlled comment UID without verifying it belongs to the parent issue the caller is authorized for - a classic CWE-639 IDOR. The impact is limited to integrity (VI:L); there is no confidentiality (VC:N) or availability (VA:N) impact, which matches the source diff showing the attacker can only overwrite the text of an existing comment, not read or delete data or take down the service. Signal comparison: there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or probable mass exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent cross-tenant integrity flaw. The confirmed patch and the public upstream bug-tracker issue lower the barrier to understanding the flaw, but no confirmed working exploit code is listed. Net: a real priority for multi-tenant Bytebase operators to patch on a normal cycle, not a drop-everything emergency.

A user holding only a Project Viewer role in Project A - the lowest privilege level - crafts an UpdateIssueComment API request that names one of their own Project A issues as the parent while pointing the IssueComment name at a comment UID belonging to Project B, which they cannot access. Because the pre-3.16.0 handler looked up the comment solely by its UID without checking it belonged to the parent issue, the attacker's new text overwrites the foreign comment. No public working exploit is listed, though the upstream GitHub issue (#19369) and the fixing PR publicly document the flaw.