---
id: CVE-2026-86116
title: >-
  Metabase versions before 0.63.1 fail to enforce data analyst permission checks
  on glossary API endpoints, allowing any authenticated user to create, modify,
  and delete glossary entries
summary: >-
  Metabase versions before 0.63.1 fail to enforce data analyst permission checks
  on glossary API endpoints, allowing any authenticated user to create, modify,
  and delete glossary entries. Attackers can submit requests to POST, PUT, and
  DEL…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-862
vendor: metabase
product: metabase
affected:
  - metabase >= 0.57.0 < 0.63.1
published: '2026-09-05'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86116'
references:
  - url: 'https://github.com/geo-chen/oss/blob/main/metabase.md'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/metabase/metabase'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj
    label: disclosure@vulncheck.com
  - url: 'https://github.com/metabase/metabase/commit/0a0589299cfd'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/metabase/metabase/releases/tag/v0.63.1'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0043
epssPercentile: 0.34472
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T17:26:29.950481Z'
ingestedAt: '2026-09-06T07:51:55.935Z'
---

## Overview

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.