CVE-2026-72900

Summary

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

Affected Software

VendorProductVersion RangeStatus
MetabaseMetabasex.58.0 < x.58.24affected
MetabaseMetabasex.58.24unaffected
MetabaseMetabasex.59.0 < x.59.21affected
MetabaseMetabasex.59.21unaffected
MetabaseMetabasex.60.0 < x.60.17affected
MetabaseMetabasex.60.17unaffected
MetabaseMetabasex.61.0 < x.61.11affected
MetabaseMetabasex.61.11unaffected
MetabaseMetabasex.62.0 < x.62.9affected
MetabaseMetabasex.62.9unaffected
MetabaseMetabasex.63.0 < x.63.5affected
MetabaseMetabasex.63.5unaffected

Weaknesses

  • CWE-862: CWE-862 Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References