Metabase SSO users able to circumvent IdP login by doing password reset

6.5 CVSS

Vulnerability Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39360

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from metabase

View All →

CVE-2025-32382

Snowflake credentials logged by the Metabase backend

Low 1.8

CVE-2025-30371

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Low 2.1

CVE-2025-27141

Metabase Enterprise Edition allows cached questions to leak data to impersonated users

Medium 4.8

CVE-2024-55951

Metabase sandboxed users could see filter values from other sandboxed users

Medium 4.8

CVE-2023-37470

Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

Critical 10

Affected Vendor

metabase

View all reports →

Affected Software

metabase

Vulnerable Versions:

< 0.41.9, >= 0.42.0, < 0.42.6, >= 0.43.0, < 0.43.7, >= 0.44.0, < 0.44.5, >= 1.0.0, < 1.41.9, >= 1.42.0, < 1.42.6, >= 1.43.0, < 1.43.7, >= 1.44.0, < 1.44.5