Vulnerability Description
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/dataease/SQLBot
- https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/dashboard/crud/dash
- https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/system/schemas/perm
- https://github.com/dataease/SQLBot/commit/fccdd29421dfc32d3a552ab29b2554974e1ebc
- https://github.com/dataease/SQLBot/issues/1377
- https://www.vulncheck.com/advisories/sqlbot-through-1.10.1-improper-access-contr
FAQ
What is CVE-2026-93660?
CVE-2026-93660 is a vulnerability with a CVSS score of 6.5 (MEDIUM). SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers ...
How severe is CVE-2026-93660?
CVE-2026-93660 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93660?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.