Executive brief
Mathesar is a web-based interface used to manage PostgreSQL databases. A security flaw allowed logged-in users to view internal information about databases they were not authorized to access, such as table structures and user lists. In some cases, this could allow unauthorized users to submit data through public forms by obtaining secret form tokens.
Technical details
A missing authorization vulnerability (CWE-862) exists in Mathesar's RPC methods, including collaborators.list, tables.metadata.list, explorations.list, and forms.list. These endpoints accepted a database_id without verifying if the requesting authenticated user was a collaborator on that specific database. An attacker with low privileges could exploit this to leak metadata such as table schemas, collaborator mappings, and form tokens. For public forms, the exposure of a form token allows the attacker to submit data to the form under the configured PostgreSQL role. The issue is fixed in version 0.10.0 by implementing consistent collaborator verification for database-scoped requests.
Affected products
- Mathesar Foundation Mathesar >= 0.2.0, < 0.10.0
Timeline
- 2026-04-23: advisory: GitHub Security Advisory published
- 2026-05-15: disclosed: CVE published to NVD
- 2026-05-15: patched: Fix confirmed in version 0.10.0