GitHub Advisoryadvisory · npm

GHSA-v226-32c7-x2v7 Cube Core is vulnerable to privilege escalation via a specially crafted request

HIGH Published 2026-02-10 Modified 2026-02-10 Official page ↗
Aliases
CVE-2026-25958
Ecosystem
npm
Packages
@cubejs-backend/server-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-807
Reviewed
2026-02-10

Affected packages

• npm @cubejs-backend/server-core: >= 0.27.19, < 1.0.14 → fixed in 1.0.14 • npm @cubejs-backend/server-core: >= 1.1.0, < 1.4.2 → fixed in 1.4.2 • npm @cubejs-backend/server-core: >= 1.5.0, < 1.5.13 → fixed in 1.5.13

Description

Impact It is possible to make a specially crafted request with a valid API token that leads to privilege escalation. Affected Versions: `≥= 0.27.19` Mitigation: Upgrade to a patched version: • 1.5.13 and later (regular release) • 1.4.2 (active LTS release) • 1.0.14 (end-of-life LTS release) References The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

Related

Alias · CVE (1)

  • CVE-2026-25958 Cube is a semantic layer for building data applications. vulnerability

Weakness · CWE (1)

  • CWE-807 Reliance on Untrusted Inputs in a Security Decision weakness

References