Metabase, a popular open-source business intelligence and data visualization tool, has disclosed an active zero-day vulnerability known as GHSA-vwf4-m7j8-wcjf that allows unauthenticated attackers to gain full administrator access on affected instances This article explores vulnerability known ghsa. . The flaw carries a maximum CVSS score of 10.0 and affects all versions from Metabase 1.58 onwards, including branches 0.58 through 0.63.
Although no CVE identifier has been assigned as of this report, the severity and confirmed real-world exploitation make it one of the most dangerous vulnerabilities disclosed in cybersecurity for business intelligence platforms this year. This gives them full control over the instance, enabling them to modify application configuration settings, extract all stored credentials for connected databases, read any data accessible through those connections, and export sensitive information at will.
Data theft incidents linked to the zero-day exploit have already been reported by companies Framework and Tally, which experienced unauthorized access to customer information such as names, addresses, phone numbers, and emails. If the password reset endpoint was previously accessible before patches were applied, security teams should revoke all active sessions by clearing the core_session table, audit API keys for anything unfamiliar, review administrator accounts for unexpected changes, rotate credentials for every connected database, and thoroughly examine data warehouse and Metabase query logs for signs of unauthorized activity.
