CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on the glossary API endpoints, a missing-authorization flaw (CWE-862). Any authenticated user, regardless of assigned permissions, can send POST, PUT, and DELETE requests to the glossary endpoints. This lets the user create, modify, or delete instance-wide business glossary entries without proper authorization, corrupting shared business terminology (high integrity impact, no confidentiality impact; CVSS 4.0 score 7.1, High). All Metabase deployments prior to 0.63.1 that grant access to non-admin users are affected. No public proof-of-concept or in-the-wild exploitation is known, it is not listed in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to Metabase 0.63.1 or later. As an interim mitigation, restrict access to the glossary API endpoints at a reverse proxy so only authorized analysts or admins can issue POST, PUT, and DELETE requests, and review audit logs for glossary changes made by non-analyst accounts.