CVE-2026-25958

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-807

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-259599.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData`CVE-2026-259609.8vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be byCVE-2026-259617.5SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (ICVE-2026-259626.5MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip filCVE-2026-259636.5Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template dCVE-2026-259644.9Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerCVE-2026-259657.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImaCVE-2026-259667.8ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includesCVE-2026-259677.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffCVE-2026-259689.8ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a sCVE-2026-259697.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exisCVE-2026-25977.5Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes(). The function
CVE-2026-25958: High severity, CVSS 7.7 | Vulnix