Is there a patch available for CVE-2026-44719?

Yes, a patch is available for CVE-2026-44719. Update the affected software to the latest version immediately.

Mathesar CVE-2026-44719

Q: What is the CVSS score of CVE-2026-44719?

CVE-2026-44719 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30587 MEDIUM

Missing Authorization (CWE-862)

2026-05-15 GitHub_M

Authentication Bypass PostgreSQL

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 15, 2026 - 20:02 EUVD

Analysis Generated

May 15, 2026 - 19:36 vuln.today

CVSS changed

May 15, 2026 - 19:22 NVD

5.3 (MEDIUM)

DescriptionGitHub Advisory

Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, collaborators.list, tables.metadata.list, explorations.list, and forms.list accept a database_id without verifying that the requesting user was a collaborator on that database. An authenticated user on the same Mathesar installation could use these methods to view Mathesar-managed metadata for databases where they were not a collaborator. Depending on the database and features in use, exposed metadata could include collaborator mappings, table metadata, saved exploration metadata, and form metadata. For forms, the exposed metadata included form tokens. For public forms, possession of the token is equivalent to possession of the public form link, which allows submission to the form under the form’s configured PostgreSQL role. This vulnerability is fixed in 0.10.0.

AnalysisAI

Authenticated users in Mathesar 0.2.0 through 0.9.x can access metadata for PostgreSQL databases where they lack collaborator privileges, due to missing authorization checks in four API methods (collaborators.list, tables.metadata.list, explorations.list, forms.list). Exposed data includes table schemas, saved explorations, form configurations, and critically, public form submission tokens that grant unauthorized database write access under the form's PostgreSQL role. Fixed in version 0.10.0. CVSS 5.3 (Medium) reflects network-accessible, low-complexity exploitation requiring only basic authentication. No public exploit code or active exploitation detected (EPSS data unavailable, not in CISA KEV).

Technical ContextAI

Mathesar is a web application providing a user interface layer over PostgreSQL databases with role-based collaboration controls. The vulnerability stems from CWE-862 (Missing Authorization), where four API endpoints accept a database_id parameter but fail to verify the authenticated user's collaborator status for that database before returning metadata. This authorization bypass occurs at the application layer-Mathesar's middleware does not enforce its own collaboration model before querying PostgreSQL-managed data. The affected endpoints expose different metadata types: collaborators.list reveals user-to-database mappings, tables.metadata.list exposes table schemas and Mathesar annotations, explorations.list reveals saved query configurations, and forms.list returns form definitions including security-critical form tokens. For public forms, these tokens serve as bearer credentials enabling anonymous form submission with the privileges of the form's configured PostgreSQL role, potentially allowing data insertion or modification beyond the attacker's intended access scope.

RemediationAI

Upgrade to Mathesar version 0.10.0 or later, which implements proper authorization checks verifying collaborator status before returning database metadata from affected API endpoints. Download from the project's GitHub releases page at https://github.com/mathesar-foundation/mathesar/releases. For organizations unable to immediately upgrade, implement interim controls: restrict network access to the Mathesar installation to trusted networks only using firewall rules or reverse proxy authentication, limiting the pool of potential authenticated attackers. Audit existing user accounts and remove accounts that should not have any database access. Review form configurations and regenerate form tokens for public forms that handle sensitive data, then revoke previously issued tokens if the platform supports token rotation. Consider temporarily disabling public form features if form token exposure poses unacceptable risk. Monitor application logs for unusual API access patterns, specifically requests to collaborators.list, tables.metadata.list, explorations.list, or forms.list endpoints with database_id parameters for databases the requesting user should not access. Note that workarounds only reduce attack surface and do not eliminate the vulnerability-upgrading remains the definitive solution.