Executive brief
Metabase is a business intelligence tool that lets organizations create and share data dashboards and analytics. A flaw in the glossary API allows any authenticated user to create, modify, and delete business glossary entries without proper authorization, enabling an attacker to tamper with or destroy organization-wide business terminology and definitions that other teams rely on.
Technical details
The Glossary API endpoints (POST, PUT, DELETE /api/glossary) in Metabase versions before 0.63.1 fail to enforce the data analyst permission check, despite the route being mounted under an authenticated path. The handlers in src/metabase/glossary/api.clj perform only basic 404 validation and database operations without calling the required api/check-data-analyst authorization check that is properly enforced on related endpoints like /api/measure. An authenticated user with neither superuser nor data analyst privileges can submit requests to create, modify, and delete glossary entries, achieving CWE-862 missing authorization. The vulnerability is fixed in Metabase 0.63.1 and later versions.
Affected products
- Metabase Metabase before 0.63.1
Timeline
- 2026-06-13: disclosed: Initially reported via email
- 2026-09-05: advisory: Published via NVD
- 2026-09-05: patched: Fixed in version 0.63.1