CVE-2026-44719 is a missing authorization vulnerability (CWE-862) in the Mathesar web application affecting versions >= 0.2.0 and < 0.10.0. Several API methods (collaborators.list, tables.metadata.list, explorations.list, forms.list) accept a database_id parameter without verifying that the requesting user is a collaborator on that database. This allows an authenticated user to view metadata for databases they do not have permission to access. The exposed metadata can include collaborator mappings, table metadata, saved exploration metadata, and form metadata, including form tokens. For public forms, possession of the token is equivalent to having the public form link, enabling submissions under the form's PostgreSQL role. The vulnerability is addressed in Mathesar version 0.10.0.

An authenticated user on the same Mathesar installation can access metadata of databases they are not authorized to view. This includes sensitive information such as collaborator mappings and form tokens. For public forms, this can lead to unauthorized form submissions under the configured PostgreSQL role. The impact is unauthorized disclosure of metadata and potential misuse of form submission privileges.

This vulnerability is fixed in Mathesar version 0.10.0. Users should upgrade to version 0.10.0 or later to remediate this issue. Patch status is not explicitly stated beyond the fix in 0.10.0, so users should verify upgrade availability and apply the official fix. No other mitigation or temporary workaround is indicated.