CVE-2026-72900

22th percentile - higher than 22% of all known CVEs

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

An attacker can access sensitive data stored in the Metabase database, including user data, configuration, and potentially business data.

Apply the vendor patch or upgrade Metabase to a version that fixes this vulnerability. Restrict user privileges and monitor database access.