Bytebase EUVD-2026-108124

Requires an authenticated Bytebase account with permission on at least one project (PR:L); the attacker then supplies foreign task or task-run UIDs to the GetTaskRunLog, GetTaskRunSession, and PreviewTaskRunRollback handlers in the rollout service. In versions before 3.16.0 these handlers (per the PR #19554 diff, also GetTaskRun and BatchCancelTaskRuns) resolved the task run by UID without confirming it belonged to the project/plan in the request path, so cross-project reads succeed. Limiting factors: exploitation is restricted to authenticated users (not anonymous), impact is read-only disclosure of logs/session details/rollback SQL with no write or availability effect, and it is only meaningful on instances hosting more than one project/tenant; sequential integer UIDs make enumeration of foreign objects straightforward.

This is a genuine but moderate-severity authorization flaw (CWE-639, IDOR), not a high-CVSS-but-low-risk artifact. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and is internally consistent with the description: network-reachable, low attack complexity, and crucially PR:L - an attacker must already be an authenticated, project-scoped Bytebase user. Impact is confidentiality-only and rated Low (VC:L), reflecting read access to task-run execution logs, database session details, and rollback SQL rather than full compromise; there is no integrity or availability impact. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. The input references are the upstream GitHub issue, the fix PR/commit, the release, and a VulnCheck advisory - these are remediation/analysis artifacts, not a published working exploit, so no public exploit code is identified. The vuln.today decision label is 'this_month', which aligns with the signals: a real authorization bug worth patching on a normal cadence, not an emergency. The main caveat: exposed data (logs, session details, rollback SQL) can contain sensitive schema or query information across tenant projects, so in multi-tenant Bytebase deployments the practical confidentiality impact could exceed the Low rating for specific environments.

An authenticated Bytebase user who legitimately belongs to one project crafts API requests to GetTaskRunLog, GetTaskRunSession, or PreviewTaskRunRollback supplying a task or task-run UID (a sequential integer) belonging to a different project. Because the pre-3.16.0 handlers resolved the task run by UID without verifying it belonged to the requester's project/plan, the server returns another project's execution logs, DB session details, and rollback SQL. No public working exploit is identified, but the attack requires only a valid low-privilege account and simple UID enumeration (AV:N/AC:L/PR:L).