Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access

Metabase, the widely used open-source business intelligence and data visualization platform, has confirmed that a critical zero-day vulnerability tracked as GHSA-vwf4-m7j8-wcjf was actively exploited in the wild, allowing unauthenticated attackers to seize full administrator access to affected instances. The flaw carries a maximum CVSS score of 10.0 and impacts every release from version 1.58 onward, spanning branches 0.58 through 0.63. Although no CVE identifier has been assigned as of this writing, the severity and confirmed real-world exploitation make this one of the most dangerous business intelligence platform vulnerabilities disclosed this year. The vulnerability is an unauthenticated SQL injection flaw that lives in the...

Read the full article at the source.