London property manager breach may have exposed bank details and lockbox codes
London property manager City Relay says attackers exploited a Metabase Cloud vulnerability twice, stealing landlord bank details, passwords, and lockbox codes.
58
Victim
Framework
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 12, 2026
- Last mentionedSep 17, 2026
Timeline
3 articles · newest firstWeek in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
32
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.
90
Related CVEs
by mentions- CVE-2026-7289899%10.0Unauthenticated SQL Injection in Metabase Grants Admin Access
- CVE-2026-203491%8.6Unauthenticated Remote DoS in Cisco ASA/FTD SSL VPN Service
- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2026-68820<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2023-3864699%9.8Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's…
Appears with
- n8norganization · 2
- Metabaseproduct · 2
- Metabase Cloudproduct · 2
- Metabasevendor · 2
- Frameworkorganization · 2
- CISAvendor · 2
- n8nvictim · 2
- Salesforceproduct · 1
- City Relayorganization · 1
- Picus Labsorganization · 1
- GitHubvendor · 1
- Ciscovendor · 1
- Entra IDproduct · 1
- Engadgetorganization · 1
- Wizvendor · 1
- Kilo Codeorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.