Is CVE-2026-86116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86116 being exploited in the wild.

How severe is CVE-2026-86116?

Medium severity, with a CVSS score of 6.5, published 5 September 2026.

Is there a fix for CVE-2026-86116?

A patch was published on 2026-09-05: Fixed in version 0.63.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86116 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86116?

Check whether you run Metabase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86116: Metabase glossary API missing authorization checks

CVE-2026-86116 · Severity: medium · CVSS 6.5 · Published 2026-09-05

Metabase is a business intelligence tool that lets organizations create and share data dashboards and analytics. A flaw in the glossary API allows any authenticated user to create, modify, and delete business glossary entries without proper authorization, enabling an attacker to tamper with or destroy organization-wide business terminology and definitions that other teams rely on.

Technologies: Metabase. Vendors: Metabase.

Quick answers

Is CVE-2026-86116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86116 being exploited in the wild.
How severe is CVE-2026-86116?: Medium severity, with a CVSS score of 6.5, published 5 September 2026.
Which products and versions are affected?: Metabase before 0.63.1.
Is there a fix for CVE-2026-86116?: A patch was published on 2026-09-05: Fixed in version 0.63.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86116 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86116?: Check whether you run Metabase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Glossary API endpoints (POST, PUT, DELETE /api/glossary) in Metabase versions before 0.63.1 fail to enforce the data analyst permission check, despite the route being mounted under an authenticated path. The handlers in src/metabase/glossary/api.clj perform only basic 404 validation and database operations without calling the required api/check-data-analyst authorization check that is properly enforced on related endpoints like /api/measure. An authenticated user with neither superuser nor data analyst privileges can submit requests to create, modify, and delete glossary entries, achieving CWE-862 missing authorization. The vulnerability is fixed in Metabase 0.63.1 and later versions.

Affected products

Metabase Metabase before 0.63.1

Timeline

2026-06-13: disclosed: Initially reported via email
2026-09-05: advisory: Published via NVD
2026-09-05: patched: Fixed in version 0.63.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.