CVE-2026-86116: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-05 · updated 2026-09-24
Weakness: CWE-862

Description

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

Affected products

metabase: from 0.57.0 before 0.63.1 — fixed in 0.63.1

How to fix

Upgrade to a fixed version: metabase 0.63.1. Check the vendor advisory for mitigations.

References

https://github.com/geo-chen/oss/blob/main/metabase.md
https://github.com/metabase/metabase
https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj
https://github.com/metabase/metabase/commit/0a0589299cfd
https://github.com/metabase/metabase/releases/tag/v0.63.1
https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api

Get alerted when CVE-2026-86116 or the next vulnerability affects your stack