CVE-2026-93660 — SQLBot through 1.10.1 Improper Access Control via Dashboard Update
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private…
Published: 2026-09-18 · CVSS: 7.1 · CVSS 4.0
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7