The vulnerability allows an authenticated Mathesar user who is not a collaborator on a database to read, replace, or delete the definition of an exploration belonging to that database. The missing collaborator checks occur in the explorations.get, explorations.replace, and explorations.delete endpoints, meaning an attacker can disclose, alter, or erase metadata such as capitalized columns, filters, sorting, and transformation settings. This compromise enables partial data exposure and manipulation of user‑defined analytical configurations.

Mathesar products from 0.2.0 through 0.9.x are affected; the issue is resolved starting with version 0.10.0. The affected vendor is Mathesar Foundation, and the product is Mathesar, a PostgreSQL–oriented web interface.

With a CVSS score of 5.3, the scenario is considered moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The likely attack vector is internal; a malicious user must be authenticated to the same Mathesar installation and must discover or guess a valid exploration_id. Because the only permissive condition is the lack of collaborator verification, exploitation does not require elevated privileges beyond ordinary authentication, though it remains non‑trivial to discover the correct identifiers.