What is the CVSS score of CVE-2026-25958?

CVE-2026-25958 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cube.Js are affected by CVE-2026-25958?

Cube semantic layer deployments are vulnerable to privilege escalation attacks when users possess valid API tokens, potentially allowing attackers to gain unauthorized administrative access to data…. A patch is available.

How to fix or mitigate CVE-2026-25958?

Within 24 hours: Inventory all Cube deployments and identify affected versions; restrict API token distribution and rotate existing tokens immediately. Within 7 days: Implement network segmentation to limit Cube access, enable comprehensive API logging and monitoring for suspicious token usage patterns, and escalate to vendor for patch timeline. Within 30 days: Upgrade to patched versions (1.5.13, 1.4.2, or 1.0.14 or later) as soon as available, conduct access review audit, and implement principle of least privilege for all API token assignments.

Cube.Js CVE-2026-25958

HIGH

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-02-09 security-advisories@github.com

GHSA-v226-32c7-x2v7

Privilege Escalation Cube.Js

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 09, 2026 - 23:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.

AnalysisAI

Privilege escalation in Cube.js versions 0.27.19 through 1.5.12 allows authenticated attackers to craft specially designed API requests that bypass access controls and gain elevated privileges within the application. This vulnerability affects Cube.js semantic layer deployments and requires only a valid API token to exploit, making it a risk to multi-tenant or role-based access control implementations. No patch is currently available for this HIGH severity issue.

Technical ContextAI

Affects Cube.Js. Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.