CVE-2026-86116

    Dashboard / Vulnerabilities / CVE-2026-86116

    CVE-2026-86116

    Published: 5 Sept 2026Last Modified: 26 Sept 2026

    Summary: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

    Details: Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86116.json, https://github.com/metabase/metabase/releases/tag/v0.63.1, https://nvd.nist.gov/vuln/detail/CVE-2026-86116, https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api, https://github.com/metabase/metabase/commit/0a0589299cfd, https://github.com/metabase/metabase, https://github.com/geo-chen/oss/blob/main/metabase.md, https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 69f9d5992894adaae21e23b52ea651c540eadcff
    Fixed -50ebc554590399ed69d602144af81ea285ad02c5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86116 | CVE-DB