Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 12:35:32 +0000 CVE-2026-86116 — Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API https://db.gcve.eu/vuln/cve-2026-86116 <p><strong>Affected:</strong> metabase</p> <p>Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.</p> <p><strong>Affected:</strong> metabase</p> <p>Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.</p> https://db.gcve.eu/vuln/cve-2026-86116