Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-72900 Details

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

CVSS 3.x Severity and Vector Strings:

CNA: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian GovernmentCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
https://www.cve.org/CVERecord?id=CVE-2026-72900	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

CWE-ID	CWE Name	Source
CWE-862	Missing Authorization	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

No affected product data is available for this CVE.

2 change records found show changes

Date	Action	Recorded By
Aug 10, 2026	CVE Modified	CISA-ADP
Aug 10, 2026	New CVE Received	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

QUICK INFO