CVE-2026-86116 in Metabase
Summary
by MITRE • 09/05/2026
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Metabase versions prior to 0.63.1 represents a critical failure in access control mechanisms within the application's API layer. Specifically, the flaw resides in the handling of requests directed at glossary-related endpoints, which are designed to manage business definitions and metadata for data analysts. In a properly secured environment, these operations should be restricted to users with specific administrative or elevated permissions, as modifying global business glossaries can significantly impact how data is interpreted across an organization. However, due to the absence of rigorous permission checks on these particular endpoints, the authentication layer fails to validate whether the authenticated user possesses the necessary privileges to perform write operations such as creation, modification, or deletion of glossary entries.
This technical flaw allows any authenticated user, regardless of their assigned role or clearance level within Metabase, to interact with the glossary API without restriction. An attacker who has obtained valid credentials for a low-privilege account can exploit this misconfiguration by sending crafted HTTP requests using POST, PUT, and DELETE methods against the relevant endpoints. The application processes these requests as legitimate administrative actions because it does not verify the user's role before executing the database changes associated with glossary management. This bypass of authorization logic effectively elevates the capabilities of a standard user to that of an administrator for this specific subsystem, undermining the principle of least privilege that is fundamental to secure software architecture.
The operational impact of this vulnerability extends beyond simple data tampering and can lead to significant business intelligence integrity issues. By altering or deleting glossary entries, an attacker can distort the semantic meaning of datasets used by analysts and decision-makers within the organization. This could result in misleading reports, incorrect financial calculations, or flawed strategic decisions based on corrupted metadata. Furthermore, if an attacker injects malicious definitions into the glossary, it may facilitate social engineering attacks where users are tricked into trusting compromised data sources. The ability to delete entries can also cause operational disruptions by removing critical context required for understanding complex datasets, thereby degrading the overall utility of the analytics platform and potentially causing downtime while administrators restore lost metadata.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as the system fails to enforce appropriate access controls on sensitive resources. It also relates closely to CWE-862, Missing Authorization, since the application does not perform an authorization check before allowing actions that modify critical configuration data. In terms of offensive security frameworks, this behavior is consistent with techniques observed in MITRE ATT&CK under privilege escalation and defense evasion categories, where attackers leverage misconfigured permissions to gain unauthorized access or alter system state without detection by standard monitoring tools designed for higher-level threats.
To mitigate this vulnerability, organizations running Metabase must upgrade immediately to version 0.63.1 or later, which includes the necessary patches to enforce strict permission checks on all glossary API endpoints. Until an upgrade is feasible, administrators should consider implementing network-level controls such as web application firewalls that can inspect and restrict access to these specific API paths based on user roles if supported by their infrastructure. Additionally, it is advisable to review audit logs for any suspicious activity involving glossary modifications during the window of exposure to assess whether exploitation has occurred. Regular security assessments and penetration testing should be conducted to identify similar authorization flaws in other parts of the application, ensuring that all administrative functions are properly gated behind robust identity verification processes.