Metabase Enterprise Edition up to 1.50.35/1.51.10/1.51.13/1.53.1 permission assignment

Summaryinfo

A vulnerability classified as problematic was found in Metabase Enterprise Edition up to 1.50.35/1.51.10/1.51.13/1.53.1. This affects an unknown part. Executing a manipulation can lead to permission assignment. This vulnerability is handled as CVE-2025-27141. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Metabase Enterprise Edition up to 1.50.35/1.51.10/1.51.13/1.53.1 and classified as problematic. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a permission assignment vulnerability. The CWE definition for the vulnerability is CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. As an impact it is known to affect confidentiality. CVE summarizes:

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see results of cached questions, even if their permissions don’t allow them to see the data. If some user runs a question which gets cached, and then an impersonated user runs that question, then the impersonated user sees the same results as the previous user. These cached results may include data the impersonated user should not have access to. This vulnerability only impacts the Enterprise Edition of Metabase and not the Open Source Edition. Versions 1.53.2, 1.52.11, 1.51.14, and 1.50.36 contains a patch. Versions on the 1.49.X, 1.48.X, and 1.47.X branches are vulnerable but do not have a patch available, so users should upgrade to a major version with an available fix. Disabling question caching is a workaround for this issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-27141 since 02/19/2025. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.50.36, 1.51.11, 1.51.14 or 1.53.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Metabase

Name

• Enterprise Edition

Version

• 1.50.0
• 1.50.1
• 1.50.2
• 1.50.3
• 1.50.4
• 1.50.5
• 1.50.6
• 1.50.7
• 1.50.8
• 1.50.9
• 1.50.10
• 1.50.11
• 1.50.12
• 1.50.13
• 1.50.14
• 1.50.15
• 1.50.16
• 1.50.17
• 1.50.18
• 1.50.19
• 1.50.20
• 1.50.21
• 1.50.22
• 1.50.23
• 1.50.24
• 1.50.25
• 1.50.26
• 1.50.27
• 1.50.28
• 1.50.29
• 1.50.30
• 1.50.31
• 1.50.32
• 1.50.33
• 1.50.34
• 1.50.35
• 1.51.0
• 1.51.1
• 1.51.2
• 1.51.3
• 1.51.4
• 1.51.5
• 1.51.6
• 1.51.7
• 1.51.8
• 1.51.9
• 1.51.10
• 1.51.11
• 1.51.12
• 1.51.13
• 1.53.0
• 1.53.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion