Organisations at risk: Bytebase flaw allows unauthenticated attackers to assume any user identity via GitLab

Organisations using Bytebase for database change management face a severe identity risk. An authentication bypass vulnerability in versions 0.12.0 before 1.0.1 allows unauthenticated attackers to log in as any existing user. The National Vulnerability Database assigns the flaw a CVSS score of 9.3, categorising it as critical. This means attackers can fully compromise user accounts without needing passwords or tokens.

The risk

The vulnerability, tracked as CVE-2022-51026, stems from how Bytebase handles self-hosted GitLab authentication. The application trusts client-supplied configuration data in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. An attacker can supply a custom instanceUrl pointing to a server they control. That server returns a fake active user with a chosen email address. Bytebase then issues a valid session token for that principal. This allows the attacker to impersonate existing users, including the Owner, or create new members. The weakness is classified under CWE-290, relating to authentication issues.

Who is exposed

Any organisation running Bytebase versions 0.12.0 before 1.0.1 is exposed to this threat. The risk is specific to deployments that use the self-hosted GitLab provider for authentication. As CloudSec Pulse reported on 2026-10-12 regarding GitLab patches, self-managed infrastructure often faces urgent requirements to fix authorization flaws. That context highlights the broader challenge of securing self-hosted identity providers that integrate with development tools.

Cost and compliance

The source material does not detail financial costs or specific compliance impacts. The National Vulnerability Database record focuses on the technical severity and the ability to bypass authentication. It does not mention regulatory penalties, insurance implications, or business interruption costs. Organisations must assess their own compliance frameworks to determine how an unauthorised session token issuance affects their audit trails and data protection obligations.

What happens next

Managers should immediately verify the version of Bytebase running in their environments. If the version is 0.12.0 before 1.0.1, the system is vulnerable to unauthenticated access. Review access logs for any login attempts that used the self-hosted GitLab endpoint. Coordinate with security teams to implement network-level restrictions on the authentication endpoint if an immediate patch is not feasible.

Questions to ask your suppliers

Organisations should ask their software vendors about their authentication security models. Teams usually need to know if the supplier validates external identity provider configurations. Check whether the vendor monitors for unauthorized changes to login endpoints. Ask if there are plans to harden the API against client-supplied configuration attacks. Share this incident with your security and compliance leads. They need to assess if similar risks exist in other integrated tools. Ensure your incident response plan covers identity provider compromise scenarios.

Background: National Vulnerability Database

The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.

Read the full guide: National Vulnerability Database Explained: How NVD Works for You

What to do and how to stay safe: Bytebase

• Check your Bytebase version immediately and compare it against the affected range of 0.12.0 before 1.0.1.
• Review authentication logs for any login attempts that used the self-hosted GitLab endpoint.
• Restrict network access to the authentication API endpoint to prevent untrusted inputs.
• Monitor for new member creations or privilege escalations in your Bytebase dashboard.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2022-51026?

It is a critical authentication bypass vulnerability in Bytebase that allows unauthenticated attackers to impersonate any user.

Which versions of Bytebase are affected?

Versions 0.12.0 before 1.0.1 are affected by this vulnerability.

How does the attack work?

Attackers supply a malicious instanceUrl in the GitLab login endpoint, causing Bytebase to issue session tokens for attacker-controlled identities.