Mathesar is a web application for managing PostgreSQL database explorations. Versions >=0.2.0 and <0.10.0 have an authorization bypass vulnerability (CWE-639, CWE-862) in the explorations.get, explorations.replace, and explorations.delete functions. These functions operate on exploration_id parameters without verifying that the requesting user is a collaborator on the associated database. Consequently, an authenticated user who knows or guesses an exploration ID can read, replace, or delete exploration data they should not have access to. This vulnerability affects saved exploration definitions including metadata and query configurations. The issue is resolved in version 0.10.0.

An authenticated user on the same Mathesar installation can access or modify saved exploration data for databases where they are not authorized collaborators. This can lead to unauthorized disclosure, modification, or deletion of exploration definitions, potentially impacting data integrity and confidentiality within the application context. There is no indication of remote unauthenticated exploitation or broader system compromise from the provided data.

Upgrade Mathesar to version 0.10.0 or later, where this authorization bypass vulnerability is fixed. Since the product is not a cloud service, users must apply this update themselves. Patch status is confirmed by the vendor stating the fix is included in version 0.10.0. No other mitigation steps are indicated.