CVE-2026-72900 Metabase CVE debrief

Who should care

Metabase administrators, security teams, and users with access to Metabase application databases should verify and restrict user privileges. Affected operators and platforms should review the vulnerability and apply vendor patches or updates when available. Vulnerability management and security teams should prioritize verifying and restricting access to the Metabase application database.

Technical summary

CVE-2026-72900 is a HIGH severity vulnerability in Metabase, allowing authenticated, low-privileged attackers to read the entire application database, with a CVSS score of 7.1. The vulnerability affects Metabase application databases, and defenders should verify and restrict user privileges. The official CVE and NVD records provide limited detail, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Authenticated low-privileged attackers may access Metabase application databases; verify and restrict Metabase user privileges.

Recommended defensive actions

• Verify Metabase user privileges and access controls.
• Restrict database access to necessary personnel.
• Monitor Metabase application logs for suspicious activity.
• Apply vendor patches or updates when available.
• Perform regular security audits and vulnerability assessments.

Evidence notes

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database; official CVE and NVD records provide limited detail. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. Metabase administrators should verify user privileges and restrict access to the application database. Evidence is limited, and defenders should verify the affected scope and apply vendor patches or updates when available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.