Nemanjaglumac

**Name of the Vulnerable Software and Affected Versions** Metabase versions prior to 0.44.7 Metabase versions prior to 0.45.4 Metabase versions prior to 0.46.3 Metabase versions prior to 1.44.7 Metabase versions prior to 1.45.4 Metabase versions prior to 1.46.3 **Description** Metabase is an open source business analytics engine. The issue arises from the lack of enforcement of a requirement that users should be in at least one group with native query editing permissions to a database to edit SQL Snippets. This meant that anyone, including people in sandboxed groups, could edit SQL snippets via the API or the application UI. If a snippet contained logic that restricted data access, editing it could potentially change a person's level of data access. **Recommendations** For Metabase versions prior to 0.44.7, upgrade to version 0.44.7 or later. For Metabase versions prior to 0.45.4, upgrade to version 0.45.4 or later. For Metabase versions prior to 0.46.3, upgrade to version 0.46.3 or later. For Metabase versions prior to 1.44.7, upgrade to version 1.44.7 or later. For Metabase versions prior to 1.45.4, upgrade to version 1.45.4 or later. For Metabase versions prior to 1.46.3, upgrade to version 1.46.3 or later. For users unable to upgrade, ensure that SQL queries used to create sandboxes exclude SQL snippets.

**Name of the Vulnerable Software and Affected Versions** Metabase versions prior to 0.43.7.1 Metabase versions prior to 1.43.7.1 Metabase versions prior to 0.44.6.1 Metabase versions prior to 1.44.6.1 Metabase versions prior to 0.45.2.1 Metabase versions prior to 1.45.2.1 **Description** Metabase is an open source data analytics platform. The issue concerns Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users should not be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. **Recommendations** For versions prior to 0.43.7.1, update to version 0.43.7.1 or later. For versions prior to 1.43.7.1, update to version 1.43.7.1 or later. For versions prior to 0.44.6.1, update to version 0.44.6.1 or later. For versions prior to 1.44.6.1, update to version 1.44.6.1 or later. For versions prior to 0.45.2.1, update to version 0.45.2.1 or later. For versions prior to 1.45.2.1, update to version 1.45.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Metabase versions prior to 0.43.7.1 Metabase versions prior to 1.43.7.1 Metabase versions prior to 0.44.6.1 Metabase versions prior to 1.44.6.1 Metabase versions prior to 0.45.2.1 Metabase versions prior to 1.45.2.1 **Description** The issue is related to Improper Privilege Management in Metabase, an open source data analytics platform. Users with fewer privileges who can view a dashboard are able to add themselves to a dashboard subscription created by someone with additional data privileges, and thus get access to more data via email. This occurs because recipients of dashboard subscriptions can view the data as seen by the creator of that subscription. **Recommendations** For versions prior to 0.43.7.1, update to version 0.43.7.1 or later. For versions prior to 1.43.7.1, update to version 1.43.7.1 or later. For versions prior to 0.44.6.1, update to version 0.44.6.1 or later. For versions prior to 1.44.6.1, update to version 1.44.6.1 or later. For versions prior to 0.45.2.1, update to version 0.45.2.1 or later. For versions prior to 1.45.2.1, update to version 1.45.2.1 or later. As a temporary workaround for Metabase instances running Enterprise Edition, admins can disable the "Subscriptions and Alerts" permission for groups that have restricted data permissions.