{"id":"GHSA-5r3p-6rj5-7937","revision":"41bb115a2061462fa61aa1a209883f3b","records":[{"revision":"41bb115a2061462fa61aa1a209883f3b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-5r3p-6rj5-7937","aliases":["CVE-2022-51026"],"title":"Bytebase vulnerable to Improper Authentication","description":"### Impact\n- GitLab login allows login by any user.\n- JWT auth token can be derived as long as the server isn't rebooted.\n- Developers can assign issues to non-admin/DBA users.","state":0,"publishedAt":"2026-03-02T17:32:24+00:00","modifiedAt":"2026-10-23T10:55:57.0793124+00:00","affected":[{"ecosystem":"Go","name":"github.com/bytebase/bytebase","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/bytebase/bytebase/security/advisories/GHSA-5r3p-6rj5-7937","https://github.com/bytebase/bytebase/commit/a578ed58e478ba5c2dadf8d538ec5c3d39c28461","https://github.com/bytebase/bytebase"],"sourceUrl":"https://github.com/advisories/GHSA-5r3p-6rj5-7937","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5r3p-6rj5-7937","identifiers":["GHSA-5r3p-6rj5-7937","CVE-2022-51026"]},"retained":false,"historicalAffected":[]}],"coverage":[]}