CVE-2026-86116

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Missing Authorization. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

Rincian

Terbit di NVD

5 September 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/geo-chen/oss/blob/main/metabase.md
• https://github.com/metabase/metabase
• https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj
• https://github.com/metabase/metabase/commit/0a0589299cfd
• https://github.com/metabase/metabase/releases/tag/v0.63.1
• https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossa...