CyberRota Analysis
AI-GeneratedMetabase versions prior to 0.63.1 are vulnerable due to inadequate enforcement of data analyst permission checks on glossary API endpoints, enabling any authenticated user to create, modify, or delete glossary entries. This flaw allows unauthorized manipulation of critical business glossary data, potentially leading to misinformation and operational disruptions. Organizations using affected versions should prioritize patching to safeguard their data integrity and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.