---
id: CVE-2026-93660
title: >-
  SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource
  and update_canvas endpoints, allowing authenticated workspace members to
  modify other users' private dashboards
summary: >-
  SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource
  and update_canvas endpoints, allowing authenticated workspace members to
  modify other users' private dashboards. Attackers can supply arbitrary
  dashboard IDs to…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-639
vendor: dataease
product: SQLBot
affected:
  - SQLBot <= 1.10.1
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:43:58.793'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93660'
references:
  - url: 'https://github.com/dataease/SQLBot'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/dashboard/crud/dashboard_service.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/system/schemas/permission.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dataease/SQLBot/commit/fccdd29421dfc32d3a552ab29b2554974e1ebc4c
    label: disclosure@vulncheck.com
  - url: 'https://github.com/dataease/SQLBot/issues/1377'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sqlbot-through-1.10.1-improper-access-control-via-dashboard-update
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0043
epssPercentile: 0.34472
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T14:35:39.762585Z'
ingestedAt: '2026-09-18T14:43:13.068Z'
---

## Overview

SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.