CVE-2026-86116— Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
Quick assessment
Affected
metabase metabase
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Metabase是美国Metabase公司开源的一个开源数据分析平台。 Metabase 0.63.1之前版本存在授权问题漏洞，该漏洞源于未对glossary API端点执行数据分析师权限检查，可能导致任何已认证用户通过POST、PUT和DELETE请求创建、修改和删除术语表条目，未经授权篡改业务术语数据。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86116
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
Source: CVE Program / CVE List V5
Vulnerability Description
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Metabase 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Metabase是美国Metabase公司开源的一个开源数据分析平台。 Metabase 0.63.1之前版本存在授权问题漏洞，该漏洞源于未对glossary API端点执行数据分析师权限检查，可能导致任何已认证用户通过POST、PUT和DELETE请求创建、修改和删除术语表条目，未经授权篡改业务术语数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-86116
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86116
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86116 (1)
Vendor Advisories for CVE-2026-86116 (1)
Proof of Concept for CVE-2026-86116 (1)
Vendor Pages for CVE-2026-86116 (2)
-
-
🔗 Release Metabase 63.1 · metabase/metabase · GitHub release-notes
IV. Related Vulnerabilities
Same product: metabase
-
CVE-2026-72900
Metabase information exposure -
CVE-2026-72899
Metabase SQL injection via public card or dashboard -
CVE-2026-72898
Metabase SQL injection via password reset endpoint -
CVE-2026-50147
Metabase: Arbitrary File Read via MySQL Connection Property -
CVE-2026-50148
Metabase: Remote Code Execution via Snowflake JDBC Driver Ar
Same vendor: metabase
-
CVE-2026-72900
Metabase information exposure -
CVE-2026-72899
Metabase SQL injection via public card or dashboard -
CVE-2026-72898
Metabase SQL injection via password reset endpoint -
CVE-2026-50147
Metabase: Arbitrary File Read via MySQL Connection Property -
CVE-2026-50148
Metabase: Remote Code Execution via Snowflake JDBC Driver Ar
Same weakness: CWE-862
-
CVE-2026-90768
CAPEv2 through commit 471ee4b REST API Task Endpoints Missin -
CVE-2026-90508
Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilt -
CVE-2026-90551
WWBN AVideo Missing Authorization via video_from_program API -
CVE-2026-90547
WWBN AVideo Missing Authorization via getBookmarks.json.php -
CVE-2026-90546
WWBN AVideo Missing Authorization via like.json.php
V. Comments for CVE-2026-86116
No comments yet