PT-2026-41351 · Mathesar Foundation · Mathesar

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-44718

NVD

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, explorations.replace, and explorations.delete operate on an exploration id without verifying that the requesting user was a collaborator on the exploration’s database. An authenticated user on the same Mathesar installation who knew or guessed an exploration ID could read, replace, or delete a saved exploration belonging to a database where they were not a collaborator. This affected Mathesar-managed saved exploration definitions, including names, descriptions, selected columns, display metadata, filters, sorting, and transformations. This vulnerability is fixed in 0.10.0.

Fix

IDOR

Missing Authorization

Weakness Enumeration

CWE-639

CWE-862

Related Identifiers

CVE-2026-44718

Affected Products

Mathesar

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-44718 · Security Note
• https://github.com/mathesar-foundation/mathesar/security/advisories/GHSA-wf8r-g5rp-w69f · Note