CVE-2026-25958: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25958 is a privilege escalation vulnerability in Cube (cube.js), a semantic layer for building data applications. It affects the @cubejs-backend/server-core npm package from version 0.27.19 up to (but not including) 1.0.14, 1.1.0 up to (but not including) 1.4.2, and 1.5.0 up to (but not including) 1.5.13. The vulnerability was discovered internally by Cube Core engineer Dmitrii Patsura (@ovr) and disclosed on February 9, 2026. It carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Cube Security Advisory).

The root cause is classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision), meaning Cube's protection mechanism relies on input values that can be manipulated by an untrusted actor to bypass security controls. An authenticated attacker with a valid (low-privilege) API token can craft a specially crafted request that causes the server-side security decision logic to incorrectly grant elevated privileges. The attack requires only network access and a valid API token — no user interaction or high-privilege credentials are needed. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (GitHub Advisory, Cube Security Advisory).

Successful exploitation allows a low-privileged authenticated attacker to escalate their privileges within the Cube deployment, with a changed scope that can affect resources beyond the initially compromised component. The primary impact is a high confidentiality breach — attackers may gain unauthorized access to sensitive data managed by the Cube semantic layer, including underlying data sources and query results. Integrity and availability are not directly impacted by this vulnerability (GitHub Advisory, Cube Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.022% (7th percentile), indicating a low near-term probability of exploitation. However, the low attack complexity and requirement for only a valid (low-privilege) API token make it relatively accessible to any authenticated user of an affected Cube deployment (GitHub Advisory).

• Logs: Unusual API requests from low-privilege API tokens accessing endpoints or data resources that should require elevated permissions; unexpected privilege-level changes reflected in Cube access logs.
• Network: Anomalous query patterns from authenticated but low-privilege API tokens, particularly requests that return data beyond the token's expected authorization scope.
• Application Behavior: Low-privilege users or API tokens successfully retrieving data or performing actions that should be restricted to higher-privilege roles within the Cube semantic layer.

Cube has released patched versions addressing this vulnerability: 1.5.13 (regular release), 1.4.2 (active LTS release), and 1.0.14 (end-of-life LTS release). All deployments running versions 0.27.19 or later should upgrade to one of these patched versions immediately. As interim measures, implement strict API token management and rotation policies, monitor for suspicious API token usage, consider network segmentation to limit access to Cube instances, and audit logs for unauthorized privilege escalation activity (GitHub Advisory, Cube Security Advisory).

The vulnerability was reported internally by Cube Core engineer Dmitrii Patsura (@ovr) via the project's internal Slack channel and was promptly patched, reflecting a responsible internal disclosure process (Cube Security Advisory). The advisory received coverage from automated vulnerability tracking services and security news aggregators including The Hacker Wire and INCIBE-CERT shortly after disclosure. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database entries.