PT-2026-41352 · Mathesar · Mathesar

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-44719

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mathesar versions 0.2.0 through 0.9.9

Description An authenticated user can view managed metadata for databases where they are not a collaborator. This occurs because the endpoints 'collaborators.list', 'tables.metadata.list', 'explorations.list', and 'forms.list' accept the database id variable without verifying the requesting user's collaborator status. Exposed metadata may include collaborator mappings, table metadata, saved exploration metadata, and form metadata. In the case of forms, the exposure of form tokens allows an attacker to submit data to public forms using the configured PostgreSQL role.

Recommendations Update to version 0.10.0.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-44719

GHSA-JH9V-HQW8-5CQ8

Affected Products

Mathesar

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44719.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44719 · Security Note
• https://github.com/mathesar-foundation/mathesar/security/advisories/GHSA-jh9v-hqw8-5cq8 · Note