CVE-2026-72900

MediumCVSS 6.5/10Last modified Aug 26, 2026

Description

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MetabaseMetabase>= x.58.0, < x.58.24; >= x.59.0, < x.59.21; >= x.60.0, < x.60.17; >= x.61.0, < x.61.11; >= x.62.0, < x.62.9; >= x.63.0, < x.63.5

References

Timeline

Published
Aug 10, 2026
Last modified
Aug 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-729019.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to exeCVE-2026-729029.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary cCVE-2026-729038.1Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traveCVE-2026-729049.3Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability eCVE-2026-729064.3ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/CVE-2026-729076.5ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/CVE-2026-729086.5ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnextCVE-2026-729097.1ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_condCVE-2026-72916.3A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL FetCVE-2026-729107.1ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trCVE-2026-729119.9ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_templatCVE-2026-729124.3CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/co
CVE-2026-72900: Medium severity, CVSS 6.5 | Vulnix