CVE record · 1 source
CVE-2026-72899
CVSS 10.0Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension)…
- Product
- BI / dashboards
- CVSS
- 10.0
- Exposure class
- Database
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension)…
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.