Technical impact
The vulnerability resides in the glossary management API of Metabase. Resources such as glossary entries can be created, updated, or deleted by any authenticated user because the API lacks proper permission checks. An attacker who authenticates to the instance can therefore tamper with instance-wide glossary data, potentially altering terminology, definitions, or metadata used throughout the organization. This flaw is a CWE-862, an authorization failure that can lead to integrity violations and misalignment of business logic for all users.
Affected Systems
Metabase deployments running any version prior to 0.63.1 are affected. The vulnerability was discovered in the Metabase project on GitHub and patches were released in the 0.63.1 release. The affected components are the glossary API endpoints accessed via POST, PUT, and DELETE routes.
Risk and Exploitability
The CVSS v3 score is 7.1, indicating high severity. No EPSS score is available, so the current estimate of exploitation probability is unknown. The vulnerability is not included in the CISA KEV catalog, suggesting no confirmed exploitation at large scale. The likely attack vector, based on the description, is that an attacker must first authenticate, which means the vulnerability is exploitable only to authenticated users. Once authenticated, an attacker can use HTTP requests to the glossary endpoints to create, modify, or delete entries.
