CVE-2023-23628 - CVE House
Back to Database
Status published Medium CVE-2023-23628

Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability Description

Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23628

Credits & Attribution

No credits recorded in the NVD database.

References

More from metabase

View All →
CVE-2025-32382
Snowflake credentials logged by the Metabase backend
Low 1.8
CVE-2025-30371
Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Low 2.1
CVE-2025-27141
Metabase Enterprise Edition allows cached questions to leak data to impersonated users
Medium 4.8
CVE-2024-55951
Metabase sandboxed users could see filter values from other sandboxed users
Medium 4.8
CVE-2023-37470
Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
Critical 10

Affected Vendor

Affected Software

metabase
Vulnerable Versions:
< 0.43.7.1, >= 0.44.0-RC1, < 0.44.6.1, >= 0.45.0-RC1, < 0.45.2.1, >= 1.0.0, < 1.43.7.1, >= 1.44.0-RC1, < 1.44.6.1, >= 1.45.0-RC1, < 1.45.2.1

Timeline

Official Publish: January 28th, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration