CVE-2026-93660CWE-639

CVE-2026-93660

Medium · published September 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00430 · 36.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-18T19:17Z
References (6)
https://github.com/dataease/SQLBot · [email protected]https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/dashboard/crud/dashboard_service.py · [email protected]https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/system/schemas/permission.py · [email protected]https://github.com/dataease/SQLBot/commit/fccdd29421dfc32d3a552ab29b2554974e1ebc4c · [email protected]https://github.com/dataease/SQLBot/issues/1377 · [email protected]https://www.vulncheck.com/advisories/sqlbot-through-1.10.1-improper-access-control-via-dashboard-update · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 14:23Z
    SQLBot through 1.10.1 Improper Access Control via Dashboard Update
    cvelistv5