Back to Database
Status published
Medium
CVE-2024-55951
Metabase sandboxed users could see filter values from other sandboxed users
Vulnerability Description
Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There are no workarounds for this issue aside from upgrading.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-55951
Credits & Attribution
No credits recorded in the NVD database.
References
More from metabase
View All →CVE-2025-32382
Snowflake credentials logged by the Metabase backend
Low
1.8
CVE-2025-30371
Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Low
2.1
CVE-2025-27141
Metabase Enterprise Edition allows cached questions to leak data to impersonated users
Medium
4.8
CVE-2023-37470
Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
Critical
10
CVE-2023-32680
Missing SQL permissions check in metabase
Medium
5.8
Affected Vendor
metabase
View all reports →Affected Software
metabase
Vulnerable Versions:
>= 1.52.0, < 1.52.2.5
Timeline
Official Publish:
December 16th, 2024
Last Modified:
December 17th, 2024
Added to House:
July 22nd, 2026