Description

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-05T10:16:42.713Z",
  "pubdate": "2026-09-05T10:16:42.713Z",
  "executiveSummary": "Metabase versions prior to 0.63.1 are susceptible to a broken access control vulnerability within the application's business glossary API endpoints. The flaw allows authenticated users, regardless of their assigned role or permission level, to bypass mandatory authorization checks when interacting with glossary data. This vulnerability stems from improper input validation and insufficient permission enforcement on the server-side API handlers.\nThe impact of this vulnerability is significant, as it grants unauthorized users full CRUD (Create, Read, Update, Delete) capabilities over business glossary entries. An attacker can manipulate global metadata, leading to the corruption of organizational definitions, potential misinformation across the platform, and the unauthorized alteration of data documentation. This vulnerability is restricted to authenticated users, meaning an attacker must possess a valid session within the Metabase instance to execute malicious requests. Because there are no additional privilege requirements beyond baseline authentication, any standard user can perform administrative-level modifications to the glossary, undermining the integrity of the business intelligence data catalog.",
  "technicalDetails": "The vulnerability resides in the API layer of Metabase that processes requests for the business glossary. Specifically, the application fails to perform necessary authorization checks for the HTTP POST, PUT, and DELETE methods targeted at glossary-related endpoints. In a secure implementation, the backend should verify that the user's security context possesses the requisite 'data analyst' or 'administrator' permissions before committing state changes to the glossary database.\nThe root cause is a failure in the application's middleware or controller logic to enforce the access control policy on specific API routes. When an authenticated user submits a request to the glossary endpoint, the application validates the user session but neglects to perform a role-based access control (RBAC) check against the requested operation. Consequently, the backend logic proceeds to execute the requested transaction as if the user were authorized.\nThe attack flow follows a straightforward pattern: 1) The attacker authenticates into the Metabase instance using standard user credentials. 2) The attacker identifies the target glossary endpoints, typically via intercepting traffic or analyzing client-side API calls. 3) The attacker crafts a malicious request—such as a DELETE request to remove existing terminology or a POST/PUT request to inject fabricated definitions—and transmits it to the server. 4) The server processes the request without validating the user's permission level, resulting in the successful unauthorized modification of the glossary data.\nThis vulnerability is classified as a broken access control issue, potentially falling under CWE-285 (Improper Authorization) or CWE-862 (Missing Authorization). The scope of the attack is instance-wide, as the glossary represents a centralized configuration component. Because the API endpoints for these modifications lack the appropriate decorator or filter to verify user authorization, any authenticated user can successfully bypass organizational security policies. The exposure is limited to the network segments where the Metabase instance is reachable, and the exploitation does not require advanced techniques beyond standard HTTP request manipulation.\nPost-exploitation, the attacker can effectively 'poison' the business glossary. By altering definitions for metrics, tables, or columns, an attacker can deceive other users within the organization, leading to incorrect analytical conclusions. Furthermore, the ability to delete entries allows for the systematic destruction of data documentation, causing operational disruption for users who rely on the glossary for reporting and data governance."
}