CVE-2025-27141: Metabase Enterprise Information Disclosure

CVE-2025-27141 Overview

CVE-2025-27141 affects Metabase Enterprise Edition, the commercial build of the Metabase business intelligence and analytics platform. The vulnerability allows users with impersonation permissions to view cached query results they should not be authorized to see. When a privileged user runs a question that gets cached, a subsequent impersonated user running the same question receives the cached output rather than a result filtered by their own impersonated permissions. The flaw affects versions 1.47.0 through the patched releases and is tracked under [CWE-732: Incorrect Permission Assignment for Critical Resource]. The Open Source Edition is not impacted.

Critical Impact
Impersonated users can retrieve cached query results that disclose data outside the scope of their row-level and column-level permissions.

Affected Products

Metabase Enterprise Edition 1.47.x (no fix available, upgrade required)
Metabase Enterprise Edition 1.48.x and 1.49.x (no fix available, upgrade required)
Metabase Enterprise Edition 1.50.x before 1.50.36, 1.51.x before 1.51.14, 1.52.x before 1.52.11, and 1.53.x before 1.53.2

Discovery Timeline

2025-02-24 - CVE-2025-27141 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27141

Vulnerability Analysis

Metabase Enterprise Edition supports connection impersonation, which maps a Metabase user to a database role so queries execute with that role's permissions. It also supports question-level caching, which stores query result sets for reuse to reduce database load. The two features intersect incorrectly in affected versions.

When a question is executed, the resulting data is written to the cache keyed by the question definition rather than by the effective database identity of the requester. A subsequent request for the same question returns the cached payload, bypassing the per-user permission evaluation that impersonation is designed to enforce. An impersonated user then sees data generated under another user's broader privileges.

The weakness falls under [CWE-732], where a security-sensitive resource (the cached result set) is made accessible to principals who should not share it. The confidentiality impact is scoped to data the privileged user already fetched into cache, so exploitation is opportunistic rather than deterministic.

Root Cause

The cache key does not incorporate the impersonated database role or the effective permission context of the requesting user. Metabase treats cached results as question-scoped artifacts and returns them without re-running the impersonation-aware permission check against the underlying rows and columns.

Attack Vector

Exploitation requires an authenticated Metabase account with impersonation permissions on a target database. The attacker runs a question that another, higher-privileged user has previously executed and triggered caching for. Metabase serves the cached dataset in place of a freshly evaluated query, exposing records the impersonated role would otherwise be denied. No network-level attack or malformed payload is required; the data exposure follows normal application workflows.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this issue at the time of publication.

Detection Methods for CVE-2025-27141

Indicators of Compromise

Query result sets returned to impersonated users that contain rows or columns outside their configured database role grants.
Metabase audit log entries showing cache hits for a question immediately after an impersonated user executes it, with no corresponding database query.
Discrepancies between row counts reported to impersonated users and the row counts returned when caching is disabled for the same question.

Detection Strategies

Review the Metabase audit log for card or question execution events correlated with cache-hit metadata and cross-reference the user's assigned impersonation role.
Compare query output deltas between a direct database session running under the impersonated role and the cached Metabase response for the same question.
Inventory all Metabase Enterprise instances and flag any running versions prior to 1.50.36, 1.51.14, 1.52.11, or 1.53.2.

Monitoring Recommendations

Enable and forward Metabase application and audit logs to a centralized log platform for retention and search.
Alert on first-time access by impersonated users to questions that have active cache entries populated by admin or elevated accounts.
Track configuration changes to the caching settings and impersonation role mappings so unauthorized relaxation is visible.

How to Mitigate CVE-2025-27141

Immediate Actions Required

Upgrade Metabase Enterprise Edition to 1.50.36, 1.51.14, 1.52.11, 1.53.2, or later immediately.
For deployments on the unsupported 1.47.x, 1.48.x, or 1.49.x branches, plan a major-version upgrade since no backport patch exists.
Audit impersonation permission assignments and remove impersonation rights from accounts that do not require them.

Patch Information

Metabase released fixes in versions 1.53.2, 1.52.11, 1.51.14, and 1.50.36. The remediation ensures cached results are evaluated against the requesting user's impersonation context before being returned. Review the GitHub Security Advisory GHSA-6cc4-h534-xh5p for the full vendor statement.

Workarounds

Disable question caching globally while planning the upgrade, as described in the Metabase Caching Documentation.
Disable caching selectively on questions and dashboards that query databases subject to impersonation rules.
Restrict impersonation configuration to databases where cache disclosure is acceptable, following the Metabase Impersonation Documentation.

bash

# Configuration example: disable question caching via environment variable
export MB_ENABLE_QUERY_CACHING=false
# Restart the Metabase service for the change to take effect
systemctl restart metabase