CVE-2026-72898

CVE-2026-72898 Metabase password-reset unauthenticated SQL injection ★ CVE-2026-72898 Metabase /api/session/resetpassword unauthenticated blind SQLi PoC ★ https://github.com/user-attachments/assets/4efe5ae3-2a41-4567-815b-ee3f731a5a59 Overview CVE-2026-72898 is an unauthenticated SQL injection in...

CVE-2026-72898

Metabase SQL Injection RCE Unauthenticated SQL injection in Metabase /api/session/resetpassword endpoint. Creates admin accounts and extracts database credentials. Affected : v58.0 - v63.3 | Patched : v58.24+, v59.21+, v60.17+, v61.11+, v62.9+, v63.5+ Quick Start pip install flask requests python...

Metabase CVE-2026-72898 reset_password SQLi

CVE-2026-72898: unauthenticated POST /api/session/resetpassword accepts user-id :raw SQL for stacked queries on PostgreSQL app DB — creates superuser and opens Metabase HTTP session. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword HoneySQL injection admin...

Metabase CVE-2026-72898 SQLi Detect

Probes POST /api/session/resetpassword for undeclared user-id :raw acceptance and optional pgsleep timing oracle. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword SQLi detection.""" from future import annotations import json import re import time from kittysploit...

Exploit for SQL Injection in Metabase

CVE-2026-72898 — Metabase unauthenticated SQL injection Indep...

Exploit for SQL Injection in Metabase

Metabase SQL Injection RCE !Exploitation Demoexploitoutpu...

Exploit for SQL Injection in Metabase

CVE-2026-72898 Metabase password-reset unauthenticated SQL inj...

Exploit for SQL Injection in Metabase

CVE-2026-72898 — Metabase unauthenticated SQL injection detec...

Metabase Query Privilege Escalation

The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...

Metabase: SQL Injection

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

EUVD-2026-55690

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

Metabase SQL injection

RISK EVALUATION Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL. In the worst case an attacker could gain administrative privileges. 2. RECOMMENDED PRACTICES Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5. See https://www.metabase.com/blog/security-update. 3...

Metabase reset_password SQLi Admin Takeover (GHSA-vwf4-m7j8-wcjf)

GHSA-vwf4-m7j8-wcjf in Metabase = v0.58.0 before the x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 patches: pre-authentication SQL injection in POST /api/session/resetpassword via HoneySQL raw-map in the user-id JSON key. On all backends, injecting a subquery that resolves to the admin...

Metabase reset_password SQLi (GHSA-vwf4-m7j8-wcjf)

Detects Metabase = v0.58.0 before x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 affected by GHSA-vwf4-m7j8-wcjf: pre-authentication SQL injection in POST /api/session/resetpassword via HoneySQL raw-map in the user-id JSON key mass parameter pollution. !/usr/bin/env python3 -- coding:...

CVE-2026-72898: Improper Neutralization of Special Elements used in an SQL Command

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

VulnCheck KEV: CVE-2026-72898

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal store...

CVE-2026-58503

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the resetpassword endpoint. This issue is fixed in versions 16.16.0 and 15.106.0...

CVE-2026-58503: Observable Discrepancy

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the resetpassword endpoint. This issue is fixed in versions 16.16.0 and 15.106.0...