CVE-2026-86116: Metabase Auth Bypass Vulnerability

CVE-2026-86116 Overview

CVE-2026-86116 is a missing authorization vulnerability [CWE-862] in Metabase versions before 0.63.1. The flaw affects the glossary management API, which fails to enforce data analyst permission checks on POST, PUT, and DELETE endpoints. Any authenticated user, regardless of role, can create, modify, or delete instance-wide business glossary entries. This exposes organizational metadata and taxonomy definitions to tampering by low-privilege accounts.

Critical Impact
Authenticated users with minimal privileges can tamper with instance-wide business glossary data, corrupting shared analytical context across the Metabase deployment.

Affected Products

Metabase versions before 0.63.1
Metabase source file src/metabase/glossary/api.clj in v0.62.1 and earlier
Deployments exposing the glossary management API to authenticated users

Discovery Timeline

2026-09-05 - CVE-2026-86116 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86116

Vulnerability Analysis

The vulnerability resides in Metabase's glossary API implementation. Metabase exposes glossary endpoints intended for data analysts and administrators to define shared business terminology. The API handlers omit the required permission checks that verify whether the calling user holds the data analyst role. As a result, all authenticated users can invoke write operations against the glossary. Attackers can inject misleading definitions, delete valid terms, or overwrite existing entries. Because glossary data drives analytical interpretation across dashboards and models, tampering has downstream integrity consequences for business reporting.

Root Cause

The root cause is a missing function-level authorization control [CWE-862] on write endpoints defined in src/metabase/glossary/api.clj. Authentication is enforced, but the code path does not evaluate whether the session holds the data analyst permission before mutating glossary state. The frontend also lacked read-only handling for users without edit permissions, allowing UI interactions that mirrored the server-side gap.

Attack Vector

Exploitation requires network access and a valid low-privilege authenticated session. An attacker submits crafted HTTP requests to the glossary POST, PUT, or DELETE routes. No user interaction from an administrator is required. The vulnerability impacts integrity only; confidentiality and availability of underlying datasets are not directly affected.

text

// Patch excerpt: frontend/src/metabase/common/components/Glossary/Glossary.module.css
 .row {
-  cursor: pointer;
+  &:not(.readOnly) {
+    cursor: pointer;
+  }

   &:hover {
+    &.readOnly {
+      background-color: transparent;
+    }
+
     .action {
       visibility: visible;
     }

Source: GitHub Commit 0a0589299cfd

The patch introduces a readOnly state in the glossary components and enforces server-side permission checks. See the VulnCheck Advisory for Metabase for additional technical context.

Detection Methods for CVE-2026-86116

Indicators of Compromise

Unexpected POST, PUT, or DELETE requests to Metabase glossary API paths originating from non-administrator accounts.
Unauthorized modification, creation, or deletion of glossary entries in Metabase audit logs.
Sessions belonging to users without the data analyst role performing glossary write operations.

Detection Strategies

Enable and review Metabase application audit logs for glossary mutation events correlated with user role metadata.
Deploy a web application firewall or reverse proxy rule that logs all requests to glossary endpoints and flags requests from unprivileged accounts.
Compare current glossary state against known-good snapshots to identify unauthorized changes.

Monitoring Recommendations

Alert on any glossary API write requests from user accounts lacking the data analyst or administrator role.
Track the rate of glossary create, update, and delete operations and threshold on anomalous spikes.
Forward Metabase reverse-proxy logs to a centralized logging platform for correlation with authentication events.

How to Mitigate CVE-2026-86116

Immediate Actions Required

Upgrade Metabase to version 0.63.1 or later, which restores the missing permission checks on glossary endpoints.
Audit existing glossary entries for unauthorized modifications and restore from backup if tampering is identified.
Review Metabase user role assignments and revoke unnecessary accounts to reduce the pool of potential abusers.

Patch Information

The fix is included in Metabase Release v0.63.1 and implemented in commit 0a0589299cfd. The patch restricts glossary write operations to users with the appropriate role and adds a readOnly presentation mode in the frontend. Refer to the GitHub Metabase Repository for release notes.

Workarounds

Restrict network access to the Metabase instance to trusted user groups until the patch is applied.
Place a reverse proxy in front of Metabase that blocks POST, PUT, and DELETE requests to glossary API paths for non-administrator sessions.
Temporarily disable non-essential user accounts to reduce the attack surface pending upgrade.

bash

# Example nginx rule blocking glossary write methods pending upgrade
location ~* ^/api/.*glossary {
    limit_except GET HEAD {
        deny all;
    }
}