CVE-2026-44719 Overview
CVE-2026-44719 is a missing authorization vulnerability [CWE-862] in Mathesar, a web application for managing PostgreSQL databases. Versions from 0.2.0 to before 0.10.0 fail to verify collaborator membership in several list endpoints. Authenticated users can query collaborators.list, tables.metadata.list, explorations.list, and forms.list with arbitrary database_id values. The endpoints return Mathesar-managed metadata for databases where the requester is not a collaborator. The exposed data can include collaborator mappings, table metadata, exploration metadata, and form metadata containing form tokens. The vulnerability is fixed in version 0.10.0.
Critical Impact
Authenticated users can enumerate metadata across all databases on the same Mathesar installation, including form tokens that grant the ability to submit data to public forms under the form's configured PostgreSQL role.
Affected Products
- Mathesar versions 0.2.0 through 0.9.x
- Mathesar deployments with multiple collaborators or multi-tenant use
- Mathesar installations using forms with public submission tokens
Discovery Timeline
- 2026-05-15 - CVE-2026-44719 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-44719
Vulnerability Analysis
The flaw resides in four RPC list methods exposed by Mathesar: collaborators.list, tables.metadata.list, explorations.list, and forms.list. Each method accepts a database_id parameter that identifies the target database. The handlers do not check whether the authenticated user holds a collaborator role on that database. Any authenticated account on the installation can therefore query metadata for any database registered in Mathesar. The exposure is limited to Mathesar-managed metadata, not the underlying PostgreSQL row data, but the metadata itself contains sensitive operational information.
The most significant exposure involves forms.list. Form records include form tokens used in public submission URLs. For forms configured for public submission, the token alone is sufficient to submit data under the PostgreSQL role assigned to the form. An attacker who harvests form tokens can write to backend tables through the public form interface without further authentication.
Root Cause
The affected endpoints implement object-level authentication but omit object-level authorization. The code authenticates the session, then proceeds to load resources by database_id without consulting the collaborator mapping. This is a textbook missing authorization pattern classified under [CWE-862].
Attack Vector
Exploitation requires only a valid Mathesar user account on the target installation. The attacker calls the vulnerable RPC methods over the network and iterates database_id values to enumerate metadata across the installation. No user interaction is required, and the attack complexity is low. The vulnerability is described in the GitHub Security Advisory GHSA-jh9v-hqw8-5cq8.
Detection Methods for CVE-2026-44719
Indicators of Compromise
- Repeated RPC calls to collaborators.list, tables.metadata.list, explorations.list, or forms.list with varying database_id values from a single session.
- Form submissions originating from IP addresses that did not previously load the corresponding public form page.
- User accounts accessing metadata for databases they are not assigned to as collaborators.
Detection Strategies
- Review Mathesar application logs for RPC requests targeting the four affected methods and correlate the database_id parameter with the requester's collaborator assignments.
- Audit PostgreSQL query logs for form-token-driven INSERT operations that lack a corresponding interactive form view event.
- Compare access patterns before and after the patch to identify accounts that performed cross-database enumeration.
Monitoring Recommendations
- Enable verbose RPC request logging on the Mathesar backend and forward logs to a centralized analytics platform.
- Alert on a single account querying metadata for more than one database_id within a short interval.
- Track form submission rates per form token and flag anomalous spikes that may indicate token abuse.
How to Mitigate CVE-2026-44719
Immediate Actions Required
- Upgrade all Mathesar installations to version 0.10.0 or later, where the authorization check is enforced.
- Rotate form tokens for any public form that may have been exposed during the vulnerable window.
- Audit collaborator assignments and remove accounts that no longer require access.
- Review form configurations and the PostgreSQL roles bound to public forms to confirm least-privilege scoping.
Patch Information
The vulnerability is fixed in Mathesar 0.10.0. The release adds collaborator verification to the four affected list endpoints. Patch details and the upstream fix are documented in the Mathesar Security Advisory GHSA-jh9v-hqw8-5cq8.
Workarounds
- Restrict Mathesar account provisioning to trusted users until the upgrade is complete.
- Disable public form submission features on versions prior to 0.10.0 to prevent abuse of leaked form tokens.
- Place the Mathesar installation behind a reverse proxy with rate limiting on RPC endpoints to slow enumeration attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
