CVE-2026-86116
Received Received - Intake

Metabase Glossary API Permission Bypass Vulnerability

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86116
EUVD
EUVD-2026-71948

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
metabase metabase to 0.63.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86116 is a missing authorization vulnerability in Metabase versions before 0.63.1. It allows any authenticated user to create, modify, or delete glossary entries via the Glossary Management API endpoints (POST, PUT, DELETE) without proper permission checks. This affects instances running versions 0.57.0 to 0.63.0.

Detection Guidance

To detect this vulnerability, check your Metabase version. If it is below 0.63.1, the system is vulnerable. Use commands like 'curl -s http://your-metabase-instance.com/api/version' or check the version in the Metabase application settings.

Impact Analysis

Unauthorized users can tamper with business glossary data, leading to incorrect or misleading information across the Metabase instance. This could disrupt analytics, reporting, and decision-making processes relying on the glossary. Confidentiality may also be compromised if sensitive glossary entries are altered or deleted.

Compliance Impact

This vulnerability could violate compliance requirements that mandate data integrity and access controls, such as GDPR's data accuracy principles or HIPAA's integrity safeguards. Unauthorized modifications to glossary entries may lead to inaccurate reporting, affecting regulatory compliance and audit trails.

Mitigation Strategies

Immediately upgrade Metabase to version 0.63.1 or later. Backup your Metabase application database before upgrading. Ensure only authorized users have access to glossary management endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart