CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on the glossary management API endpoints. Any authenticated user can send POST, PUT, or DELETE requests to create, modify, or delete glossary entries, allowing tampering with instance-wide business glossary data withou...