Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-23629

Metabase subject to Improper Privilege Management

Medium6.3EPSS 0.38%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription receive the same data: the charts shown in the email would abide by the privileges of the user who created the subscription. The issue is users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. On Metabase instances running Enterprise Edition, admins can disable the "Subscriptions and Alerts" permission for groups that have restricted data permissions, as a workaround.

Timeline

  1. ID reserved

    By GitHub_M

  2. · 12 days later

    Published

  3. · 2 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-23629, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1Medium6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L
NVDNVD · Modified3.1Medium6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
EPSS (exploitation in 30 days)
0.38% · top 68% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

  • metabase · metabase

    • affected < 0.43.7.1
    • affected >= 0.44.0-RC1, < 0.44.6.1
    • affected >= 0.45.0-RC1, < 0.45.2.1
    • affected >= 1.0.0, < 1.43.7.1
    • affected >= 1.44.0-RC1, < 1.44.6.1
    • affected >= 1.45.0-RC1, < 1.45.2.1

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-23629 badge
[![CVE-2023-23629](https://trackcve.app/badge/CVE-2023-23629.svg)](https://trackcve.app/cve/CVE-2023-23629)

Record last updated .