Description

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T18:18:53.637Z",
  "pubdate": "2026-08-10T18:18:53.637Z",
  "executiveSummary": "A security vulnerability exists within the Metabase application that permits authenticated, low-privileged threat actors to read the entirety of the underlying Metabase application database. This unauthorized data access represents a severe information disclosure risk across affected systems.\nThe vulnerability requires low-privileged authentication against the Metabase instance, lowering the exploitation barrier for malicious insiders or compromised user accounts. By leveraging standard application features or API endpoints inappropriately, an attacker can bypass intended access controls to harvest sensitive data stored within the primary data store.\nThe potential impact includes the unauthorized extraction of sensitive business intelligence data, user credentials, connection strings to external databases, and internal application metadata stored within the Metabase application database.\nOrganizations utilizing vulnerable instances of Metabase face significant confidentiality risks, as a successful exploit compromises the entire scope of data managed by the application instance. Remediation requires applying official patches or updates provided by the vendor to enforce proper authorization checks on sensitive database access points.",
  "technicalDetails": "The vulnerability stems from improper authorization enforcement within the Metabase application logic, allowing authenticated users with low privileges to issue queries or leverage administrative functionalities that expose the entire application database.\nExploitation requires the attacker to possess valid credentials granting low-privileged access to the target Metabase instance. Network exposure to the application interface is necessary to initiate the malicious request sequence.\nThe attack flow typically proceeds as follows: First, the low-privileged attacker authenticates to the Metabase application using standard user credentials. Second, the attacker interacts with specific application endpoints or diagnostic features designed to query database contents or metadata. Due to insufficient role-based access control (RBAC) validations on these specific functions, the application fails to restrict the query scope to data authorized for the low-privileged user.\nConsequently, the backend executes the request against the core application database without adequate privilege verification. The application then serializes and returns the query results containing sensitive records, which may include internal tables, user account hashes, audit logs, and configuration parameters.\nThe root cause is a failure in the authorization matrix where backend API handlers do not correctly validate whether the requesting security context possesses administrative or elevated privileges before returning comprehensive database read results.\nPost-exploitation impact includes full data compromise of the application database, potentially supplying the attacker with lateral movement vectors, valid credentials for external data sources connected to Metabase, and administrative takeover capabilities."
}