bytebase - Improper Authorization

The vulnerability resides in Bytebase's authorization logic for the /issue endpoint. Low-privilege users are not restricted from accessing issues that were created by administrators, despite the intended access control design. The affected endpoint exposes both "OPEN" and "CLOSED" issues belonging to the "Admin" user, violating the principle of least privilege [1][4].

An attacker with a low-privilege account can exploit this by simply sending GET requests to the /issue endpoint. No special authentication or elevated privileges are required beyond having a valid low-privilege session. The vulnerability exists because the server does not verify whether the requesting user is authorized to view issues that belong to other roles [1][3].

A successful exploit allows an unauthorized user to read sensitive details from admin-level issues, potentially including database schema change requests, approval workflows, and other confidential operational data. This information disclosure could aid further attacks or expose internal processes [4].

As of version 1.0.4, the vulnerable code exists in the frontend store module that retrieves issues without filtering by principal [3]. Users are advised to upgrade to a patched version of Bytebase as soon as it becomes available. No workaround is documented.