EUVD-2026-71948
GHSA-cvjh-3gm5-9h6f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, any authenticated user (PR:L), no complexity or interaction; impact is integrity-only on glossary data within unchanged scope.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
5DescriptionCVE.org
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
AnalysisAI
Missing function-level authorization on Metabase's glossary management API allows any authenticated user - regardless of role - to create, modify, and delete instance-wide business glossary entries in versions before 0.63.1. The affected endpoints (POST, PUT, DELETE on glossary routes) perform no data-analyst permission check, meaning a viewer or analyst account can tamper with shared business definitions that administrators and data teams rely on for consistent reporting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Metabase account at any privilege level (viewer, analyst, or above) - unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector scores 7.1 (High), reflecting high integrity impact with network accessibility and low-privilege authentication requirement, which is well-calibrated for this class of authorization flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The vendor-released patch is Metabase v0.63.1, available at github.com/metabase/metabase/releases/tag/v0.63.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Metabase deployments and their current versions; if any run versions before 0.63.1, immediately restrict glossary API access to administrators only and disable glossary editing for non-administrative roles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today