Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create,… (CVE-2026-86116)

A vulnerability identified as CVE-2026-86116 affects Metabase versions before 0.63.1. The issue arises from a failure to enforce data analyst permission checks on glossary API endpoints. As a result, any authenticated user with basic privileges can send POST, PUT, and DELETE requests to these endpoints, allowing them to alter glossary entries without proper authorization. This represents an authorization bypass (CWE-862) that impacts the integrity of business glossary data across the Metabase instance.

The vulnerability allows unauthorized modification of glossary data by any authenticated user, potentially leading to incorrect or maliciously altered business glossary information. While confidentiality and availability are not impacted, the integrity of critical business metadata is compromised, which could affect decision-making processes relying on this data.

A fix is available in Metabase version 0.63.1 that addresses this authorization bypass. Users should upgrade to version 0.63.1 or later to remediate this issue. Since no official patch links were provided, users should consult the Metabase official release notes or security advisories for the update. Until patched, restrict access to authenticated users and monitor for unusual glossary API activity.