CVEvulnerability
CVE-2026-86116
7.1 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-05
- Last modified
- 2026-09-24
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-862
Description
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/geo-chen/oss/blob/main/metabase.md github.com
- https://github.com/metabase/metabase github.com
- https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj github.com
- https://github.com/metabase/metabase/commit/0a0589299cfd github.com
- https://github.com/metabase/metabase/releases/tag/v0.63.1 github.com
- https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api www.vulncheck.com