CVE-2026-86116
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 5, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 5, 2026
Description
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
metabasemetabase |
|
References
- Researcher write-uptechnical-description
- Glossary POST/PUT/DELETE with no authorization checktechnical-description
- Restrict glossary permissions (#76275)patch
- metabase v0.63.1 Release Notesrelease-notes
- https://github.com/metabase/metabaseproduct
- VulnCheck Advisory: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APIthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.