PT-2025-7794 · Metabase · Metabase Enterprise Edition

Perivamsipublished · Published 2025-02-24 · Updated 2025-02-28 · CVE-2025-27141

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Metabase Enterprise Edition versions 1.47.0 through 1.49.x Metabase Enterprise Edition versions 1.50.0 through 1.50.35 Metabase Enterprise Edition versions 1.51.0 through 1.51.13 Metabase Enterprise Edition versions 1.52.0 through 1.52.10

Description The issue allows users with impersonation permissions to see results of cached questions, even if their permissions don’t allow them to see the data. This occurs when an impersonated user runs a question that was previously run by another user, resulting in the impersonated user seeing the same results as the previous user. These cached results may include data the impersonated user should not have access to.

Recommendations For Metabase Enterprise Edition versions 1.47.0 through 1.49.x, upgrade to a major version with an available fix. For Metabase Enterprise Edition versions 1.50.0 through 1.50.35, upgrade to version 1.50.36 or later. For Metabase Enterprise Edition versions 1.51.0 through 1.51.13, upgrade to version 1.51.14 or later. For Metabase Enterprise Edition versions 1.52.0 through 1.52.10, upgrade to version 1.52.11 or later. As a temporary workaround, consider disabling question caching to mitigate the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-27141

GHSA-6CC4-H534-XH5P

Affected Products

Metabase Enterprise Edition

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27141.json · Exploit
• https://github.com/metabase/metabase/security/advisories/GHSA-6cc4-h534-xh5p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27141 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27141 · Vendor Advisory
• https://metabase.com/docs/latest/permissions/impersonation · Note
• https://twitter.com/CVEnew/status/1894153533848465689 · Twitter Post
• https://t.me/cvedetector/18832 · Telegram Post
• https://t.me/cvenotify/112809 · Telegram Post
• https://metabase.com/docs/latest/configuring-metabase/caching · Note
• https://twitter.com/CVETracker/status/1894477677798539486 · Twitter Post