Skip to main content

Metabase EUVDEUVD-2026-55692

| CVE-2026-72900 HIGH
Missing Authorization (CWE-862)
2026-08-10 cisa-cg
Authentication Bypass Metabase
7.1
CVSS 4.0 · Vendor: cisa-cg
Share

Severity by source

Vendor (cisa-cg) PRIMARY
7.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable, low complexity; low privileges required (authenticated user); no integrity or availability impact; full confidentiality loss of application database.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 10, 2026 - 18:36 vuln.today
Severity Changed
Aug 10, 2026 - 18:22 NVD
MEDIUM HIGH
CVSS changed
Aug 10, 2026 - 18:22 NVD
6.5 (MEDIUM) 7.1 (HIGH)
CVE Published
Aug 10, 2026 - 17:56 cve.org
HIGH 7.1

DescriptionCVE.org

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

AnalysisAI

Full application database read in Metabase is achievable by any authenticated low-privileged user due to a missing authorization check (CWE-862). Any user with a valid account - regardless of their assigned role or permissions - can issue requests that return the entire contents of the Metabase backend database, potentially exposing database connection credentials, API keys, user account data, and sensitive query results. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privileged Metabase account
Delivery
Identify unprotected internal API endpoint
Exploit
Send crafted authorized request
Execution
Bypass missing authorization check
Persist
Read full application database
Impact
Extract upstream DB credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid, authenticated Metabase account with at least low-level privileges - guest, viewer, or any role that permits login. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) accurately reflects the threat model: network-reachable, low complexity, no special attack conditions, requiring only a low-privileged account, with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privileged Metabase account - such as a guest viewer or a contractor with read-only dashboard access - sends a crafted API request to an insufficiently protected internal endpoint. The missing authorization check allows the request to succeed, returning the full contents of the Metabase application database including upstream database connection strings and user credentials. …
Remediation The primary remediation is to apply the vendor-issued patch referenced in the GitHub Security Advisory GHSA-8hmm-hrhg-ppqp (https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit Metabase access logs for unauthorized database queries, immediately restrict network access to Metabase to essential administrators only, and rotate all database connection credentials and API keys that may be exposed in Metabase. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Metabase

View all
CVE-2026-72898 CRITICAL POC
10.0 Aug 10

SQL injection in Metabase's '/reset_password' database endpoint lets a remote, unauthenticated attacker inject arbitrary
CVE-2023-38646 CRITICAL POC
9.8 Jul 21

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
CVE-2021-41277 HIGH POC
7.5 Nov 17

Metabase is an open source data analytics platform. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2022-43776 MEDIUM POC
6.5 Oct 26

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request For
CVE-2026-72899 CRITICAL
10.0 Aug 10

SQL injection in Metabase lets an unauthenticated remote attacker execute arbitrary SQL against the connected database b
CVE-2023-37470 CRITICAL
9.8 Aug 04

Metabase is an open-source business intelligence and analytics platform. Rated critical severity (CVSS 9.8), this vulner
CVE-2023-32680 CRITICAL
9.6 May 18

Metabase is an open source business analytics engine. Rated critical severity (CVSS 9.6), this vulnerability is remotely
CVE-2022-24853 MEDIUM POC
5.3 Apr 14

Metabase is an open source business intelligence and analytics application. Rated medium severity (CVSS 5.3), this vulne
CVE-2026-50148 CRITICAL
9.1 Jul 15

Remote code execution in Metabase (open-source business intelligence platform) versions 1.54.0 through the fixed release
CVE-2026-59826 CRITICAL
9.1 Jul 09

Remote code execution in Metabase (open-source BI/analytics platform) versions 1.55.0 through the fixed releases arises

CVE-2026-59827 HIGH
8.8 Jul 09

Remote code execution in Metabase's H2 database driver allows an authenticated user with native-query privileges to run

CVE-2022-39362 HIGH
8.8 Oct 26

Metabase is data visualization software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-55692 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy