Read the docs
TI-2023-09458 Aliases CVE-2023-23629

Metabase subject to Improper Privilege Management

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Privilege escalation
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-269.

Summary

Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the "Subscriptions and Alerts" permission for groups that have restricted data permissions, as a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00378 31st percentileScored 2026-11-07
Fix Fixed metabase (metabase): 0.43.7.1, 0.44.6.1, 0.45.2.1 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Metabasemetabasebefore 0.43.7.1; 0.44.0-RC1 to before 0.44.6.1; 0.45.0-RC1 to before 0.45.2.1; 1.0.0 to before 1.43.7.1; 1.44.0-RC1 to before 1.44.6.1; 1.45.0-RC1 to before 1.45.2.10.43.7.1, 0.44.6.1, 0.45.2.1, 1.43.7.1, 1.44.6.1, 1.45.2.1Patch availableCNA
  • metabase VendorMetabase Affected before 0.43.7.1; 0.44.0-RC1 to before 0.44.6.1; 0.45.0-RC1 to before 0.45.2.1; 1.0.0 to before 1.43.7.1; 1.44.0-RC1 to before 1.44.6.1; 1.45.0-RC1 to before 1.45.2.1 Fixed in 0.43.7.1, 0.44.6.1, 0.45.2.1, 1.43.7.1, 1.44.6.1, 1.45.2.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*before 0.43.7.1; 0.44.0 to before 0.44.6.1; 0.45.0 to before 0.45.2.1; 1.0.0 to before 1.43.7.1; 1.44.0 to before 1.44.6.1; 1.45.0 to before 1.45.2.1VulnerableMetabase
  • cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:* Versions before 0.43.7.1; 0.44.0 to before 0.44.6.1; 0.45.0 to before 0.45.2.1; 1.0.0 to before 1.43.7.1; 1.44.0 to before 1.44.6.1; 1.45.0 to before 1.45.2.1 Vulnerable ·Metabase

Remediation

  • Fix · CNA metabase (metabase) Fixed in 0.43.7.1, 0.44.6.1, 0.45.2.1, 1.43.7.1, 1.44.6.1, 1.45.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23629

References

Advisory 1

  • TI-2026-51115 Metabase SQL injection via password reset endpoint KEVCVSS 4.0CRITICAL 10.0
  • TI-2021-18109 GeoJSON URL validation can expose server files and environment variables to unauthorized users KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-20003 Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow… CVSS 3.1CRITICAL 9.8
  • TI-2022-08664 File system exposure in Metabase CVSS 3.1MEDIUM 5.9
  • TI-2025-05321 Metabase dom.js parseDataUri redos CVSS 4.0MEDIUM 5.3
  • TI-2023-19078 Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint CVSS 3.1CRITICAL 10.0
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences