CVE-2026-86116CWE-862broken-access-control

CVE-2026-86116

Medium · published September 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00430 · 36.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-05T14:16Z
References (6)
https://github.com/geo-chen/oss/blob/main/metabase.md · [email protected]https://github.com/metabase/metabase · [email protected]https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj · [email protected]https://github.com/metabase/metabase/commit/0a0589299cfd · [email protected]https://github.com/metabase/metabase/releases/tag/v0.63.1 · [email protected]https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 09:59Z
    Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
    cvelistv5