CVE-2026-86116

EUVD-2026-71948
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
metabasemetabase
0.57.0 ≤
𝑥
< 0.63.1
CNA
Common Weakness Enumeration
References
https://github.com/geo-chen/oss/blob/main/metabase.md
https://github.com/metabase/metabase
https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj
https://github.com/metabase/metabase/commit/0a0589299cfd
https://github.com/metabase/metabase/releases/tag/v0.63.1
https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api