CVE-2026-86116: 
Metabase vulnerability analysis and mitigation

CVE-2026-86116 is a missing authorization vulnerability in Metabase's Glossary management API that allows any authenticated user to create, modify, and delete instance-wide business glossary entries without the required data analyst permissions. It affects Metabase versions 0.57.0 through 0.63.0 (fixed in 0.63.1). The vulnerability was reported on June 13, 2026, accepted by Metabase on June 22, 2026, and publicly disclosed on September 5, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, VulnCheck).

The root cause is CWE-862 (Missing Authorization): the Glossary API handlers in src/metabase/glossary/api.clj for POST /api/glossary, PUT /api/glossary/:id, and DELETE /api/glossary/:id perform only an api/check-404 existence check and the database operation, without calling (api/check-data-analyst) that sibling endpoints (e.g., POST /api/measure) correctly enforce (geo-chen PoC, Metabase Source). The /glossary route is mounted under (+auth ...) in api_routes.clj, meaning authentication is enforced but authorization is not. An attacker needs only a valid low-privilege Metabase session (no superuser or data analyst flag required) to exploit this over the network with low complexity. A public PoC demonstrating the exploit against v0.62.1 was published by the researcher (geo-chen PoC).

Successful exploitation allows any authenticated Metabase user — regardless of their role — to poison, tamper with, or destroy the organization-wide business glossary, compromising data integrity for all users and any AI/analytics features (such as Metabot) that rely on glossary definitions. There is no confidentiality or availability impact; the vulnerability is limited to integrity of glossary data. While lateral movement is not directly enabled, corrupted glossary definitions could mislead analysts and downstream automated processes that consume glossary metadata (GitHub Advisory, geo-chen PoC).

A public proof-of-concept was published by the researcher (geo-chen) demonstrating successful exploitation against a v0.62.1 Docker build using a low-privilege user account (is_superuser:false, is_data_analyst:false) (geo-chen PoC). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog (VulnCheck). Exploitation requires only a valid authenticated session, making it accessible to any internal user or attacker who has obtained credentials.

1. Obtain a low-privilege Metabase session: Log in to the target Metabase instance with any valid user account (no admin or data analyst role required). Retrieve a session token via POST /api/session with valid credentials.
2. Confirm vulnerability: Send a GET /api/glossary request with the session token to enumerate existing glossary entries and confirm the endpoint is accessible.
3. Create an unauthorized glossary entry: Submit POST /api/glossary with a JSON body {"term": "PWNED", "definition": "Tampered by low-priv user"} and the session token. A 200 OK response with the created entry (including is_superuser: false, is_data_analyst: false in the creator field) confirms the vulnerability.
4. Tamper with an existing entry: Send PUT /api/glossary/:id with {"term": "ExistingTerm", "definition": "TAMPERED definition - integrity violation."} to overwrite an existing glossary entry. A 200 OK response confirms success.
5. Delete glossary entries: Send DELETE /api/glossary/:id for any entry ID. A 204 No Content response confirms deletion. Verify destruction via GET /api/glossary returning an empty or modified dataset.
6. Contrast with permission-gated endpoints: Optionally confirm the authorization gap by sending POST /api/measure with the same session — this returns 403 Forbidden, demonstrating the glossary endpoints uniquely lack the authorization check (geo-chen PoC).

• Network: Unexpected POST, PUT, or DELETE HTTP requests to /api/glossary or /api/glossary/:id originating from user accounts that are not data analysts or administrators.
• Logs: Metabase API access logs showing 200 or 204 responses to glossary mutation endpoints (POST /api/glossary, PUT /api/glossary/:id, DELETE /api/glossary/:id) for users with is_data_analyst: false and is_superuser: false.
• Application Data: Unexpected creation, modification, or deletion of glossary entries; glossary entries with creator fields showing non-analyst, non-admin users; sudden disappearance of all glossary entries (mass deletion).
• Audit Events: Metabase event log entries for glossary-create, glossary-update, or glossary-delete events attributed to low-privilege user IDs (geo-chen PoC).

Upgrade Metabase to version 0.63.1 or later, which adds (api/check-data-analyst) authorization checks to the POST, PUT, and DELETE glossary API handlers (Metabase Release, Metabase Commit). For Metabase Enterprise, upgrade to v1.63.1 or later. As a temporary workaround until patching is possible, restrict network access to the /api/glossary endpoint at the reverse proxy or firewall level for non-analyst users, and monitor API logs for unauthorized glossary mutations. Reading glossary entries (GET /api/glossary) is unaffected and remains accessible to all authenticated users after patching.

The vulnerability was discovered and responsibly disclosed by security researcher geo-chen, who published a detailed write-up and PoC on GitHub (geo-chen PoC). VulnCheck assigned and published the CVE advisory (VulnCheck). No significant broader media coverage or notable community discussion beyond the advisory and PoC publication has been observed at this time.