Executive brief
Mathesar, a web-based interface for PostgreSQL databases, contained a flaw that allowed authenticated users to access or modify data visualizations and queries (explorations) belonging to other users. An attacker could view, change, or delete these saved exploration definitions if they knew or guessed the specific ID of the exploration. While this did not grant direct access to the underlying database tables or credentials, it could lead to the loss or exposure of complex data analysis configurations and metadata.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Mathesar's exploration RPC methods (explorations.get, explorations.replace, and explorations.delete). The application failed to verify if the requesting user was a collaborator on the database associated with a specific exploration_id. An authenticated attacker with network access could exploit this by guessing or obtaining an exploration ID to perform unauthorized CRUD operations on exploration definitions, including filters, sorting, and transformations. The vulnerability does not bypass PostgreSQL-level permissions or expose database credentials. The issue is resolved in version 0.10.0 by requiring a database_id and verifying collaborator status.
Affected products
- Mathesar Foundation Mathesar >= 0.2.0, < 0.10.0
Timeline
- 2026-04-23: advisory: GitHub Security Advisory published by maintainers
- 2026-05-15: disclosed: NVD publication date
- 2026-05-15: patched: Fixed in version 0.10.0