CVE-2026-44718 Overview
CVE-2026-44718 is an Insecure Direct Object Reference (IDOR) vulnerability in Mathesar, a web application for managing PostgreSQL databases. The flaw affects versions from 0.2.0 up to but not including 0.10.0. The explorations.get, explorations.replace, and explorations.delete endpoints accept an exploration_id without confirming that the requesting user is a collaborator on the exploration's underlying database. Any authenticated user who knows or guesses a valid exploration ID can read, modify, or delete saved explorations on databases where they lack authorization. The issue is tracked under [CWE-639] (Authorization Bypass Through User-Controlled Key) and is resolved in Mathesar 0.10.0.
Critical Impact
Authenticated users can access, overwrite, or delete saved exploration definitions — including names, descriptions, selected columns, filters, sorting, and transformations — on databases where they hold no collaborator role.
Affected Products
- Mathesar versions 0.2.0 through 0.9.x
- Mathesar Foundation mathesar web application
- Self-hosted Mathesar deployments with multiple database collaborators
Discovery Timeline
- 2026-05-15 - CVE-2026-44718 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-44718
Vulnerability Analysis
Mathesar exposes RPC-style endpoints for managing saved explorations, which are stored query and visualization definitions tied to a specific PostgreSQL database registered in Mathesar. The vulnerable endpoints — explorations.get, explorations.replace, and explorations.delete — accept an exploration_id parameter and act on the corresponding record. The handlers verify that the caller is authenticated, but they do not check whether that user holds a collaborator role on the database that owns the exploration. This authorization gap allows cross-tenant access within a single Mathesar installation. The exposed data includes exploration names, descriptions, selected columns, display metadata, filters, sorting rules, and transformations.
Root Cause
The root cause is missing object-level authorization on user-supplied identifiers, classified as [CWE-639]. The endpoint logic trusts the exploration_id and the user's authenticated session without joining the authorization check against the database collaborator table. Because exploration IDs are sequential integers, enumeration is straightforward.
Attack Vector
An authenticated, low-privilege user issues RPC requests to explorations.get, explorations.replace, or explorations.delete while iterating through exploration IDs. Successful requests return or modify exploration records belonging to other databases on the same installation. See the GitHub Security Advisory GHSA-wf8r-g5rp-w69f for vendor-confirmed technical details.
Detection Methods for CVE-2026-44718
Indicators of Compromise
- Unexpected modifications or deletions of saved explorations reported by database collaborators.
- Application logs showing a single authenticated user calling explorations.get, explorations.replace, or explorations.delete against a wide range of exploration_id values.
- RPC requests to exploration endpoints originating from users with no collaborator role on the target database.
Detection Strategies
- Review Mathesar request logs for sequential enumeration of exploration_id values from a single session.
- Correlate exploration RPC calls with the database collaborator table to flag cross-database access attempts.
- Audit recent explorations.replace and explorations.delete actions against the expected owning user for each exploration.
Monitoring Recommendations
- Enable verbose RPC logging on the Mathesar service and forward logs to a central SIEM for retention and analysis.
- Alert on high-volume access patterns to /api/rpc/v0/ exploration methods from non-administrative accounts.
- Track unauthorized modification or deletion of exploration records through database-level audit triggers on the explorations table.
How to Mitigate CVE-2026-44718
Immediate Actions Required
- Upgrade all Mathesar installations to version 0.10.0 or later, where the authorization check is enforced.
- Audit existing saved explorations for unexpected changes, deletions, or unauthorized reads since version 0.2.0 was deployed.
- Restrict Mathesar account creation and review the list of authenticated users on shared installations.
Patch Information
The vendor fixed the vulnerability in Mathesar 0.10.0 by adding collaborator verification to the explorations.get, explorations.replace, and explorations.delete handlers. Patch details are documented in the Mathesar GitHub Security Advisory.
Workarounds
- If immediate upgrade is not feasible, limit Mathesar accounts to trusted users only and avoid multi-tenant database hosting on a single installation.
- Place Mathesar behind a reverse proxy that enforces stricter authentication and rate limits requests to exploration RPC endpoints.
- Export and back up critical exploration definitions so unauthorized modifications can be detected and reverted.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
