Bytebase versions prior to 3.16.0 have a flaw in the UpdateIssueComment API that lets any project role, even a Project Viewer, alter comments in projects outside their normal access. By sending a request that references a foreign comment UID and sets the attacker’s own issue as the parent, the attacker can overwrite content that belongs to another project. This violates data integrity, enabling the concealment or alteration of historical discussions and reports.

The vulnerable product is Bytebase version 3.15.x and earlier. All releases prior to 3.16.0 are affected; versions 3.16.0 and later contain the fix. The vulnerability applies to any deployment where the UpdateIssueComment endpoint is reachable and clients may supply arbitrary comment UIDs.

The CVSS v3.1 base score of 5.3 indicates moderate severity, and the EPSS score is not publicly available. The vulnerability is not listed in the CISA KEV catalog. Attackers only need a project role – no privileged escalation is required. Successful exploitation requires constructing a valid API request with the target project ID, a comment UID from a different project, and the parent issue ID set to an issue in the attacker’s project. When executed, the comment in the target project will be overwritten or altered, potentially erasing logs or misrepresenting discussion history. The primary risk is the compromise of data integrity across projects.