CVE-2026-86116: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Metabaseto a version that resolves this vulnerability.Fixed in 0.63.1 - Compensating control
Temporarily restrict access to Metabase glossary management API endpoints (POST/PUT/DELETE for glossary endpoints) to trusted/authorized analysts until Metabase is upgraded to 0.63.1 or later.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Metabase user can exploit it; data analyst permission checks are not enforced on the affected glossary API endpoints. No user interaction is required.
What actions can an unauthorized user perform?
An authenticated user can send POST, PUT, and DELETE requests to glossary endpoints to create, modify, or delete instance-wide business glossary entries. The impact is limited to integrity of glossary data; the provided vector indicates no confidentiality or availability impact.
Are default deployments affected?
The issue affects Metabase versions before 0.63.1 when glossary API endpoints are available to authenticated users. The provided information does not identify any additional configuration prerequisite.
What is the remediation?
Upgrade Metabase to version 0.63.1 or later. The fix enforces the missing data analyst permission checks on glossary management API operations.