CVE Catalog
CVE-2026-72899
CriticalCVSS 10.0Summary
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
Risk Assessment
An attacker can gain unauthorized access to data in the database, potentially leading to data confidentiality and integrity breaches.
Recommendation
Apply available security patches for Metabase and restrict access to public cards and dashboards.
Original NVD description (English source)
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.