What’s Vulnerable › Vulnerabilities
CVE-2026-44718: Mathesar: Missing collaborator checks allowed access to saved explorations in other databases
- Severity: medium (CVSS 5.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-15 · updated 2026-06-17
- Weakness: CWE-639
Description
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, explorations.replace, and explorations.delete operate on an exploration_id without verifying that the requesting user was a collaborator on the exploration’s database. An authenticated user on the same Mathesar installation who knew or guessed an exploration ID could read, replace, or delete a saved exploration belonging to a database where they were not a collaborator. This affected Mathesar-managed saved exploration definitions, including names, descriptions, selected columns, display metadata, filters, sorting, and transformations. This vulnerability is fixed in 0.10.0.
Affected products
- mathesar-foundation mathesar: from 0.2.0, < 0.10.0
References
Get alerted when CVE-2026-44718 or the next vulnerability affects your stack