Medium
Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor
Type: advisorySources: OSV
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-23628
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 03:12 UTC · Revision 1
Source evidence
Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor
core-osv · Original sourcePublished 28 Jan 2023, 01:11 UTC
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.
osv:CVE-2023-23628
Complete source record
{
"id": "216d18177994299ec23d371e0121e5b5c14558d31fe26f8140fdcec1ec993a79",
"url": "https://osv.dev/vulnerability/CVE-2023-23628",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor",
"summary": "Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.",
"evidence": "osv:CVE-2023-23628",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-23628",
"aliases": [
"CVE-2023-23628",
"GHSA-492f-qxr3-9rrv"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/metabase/metabase",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "65326e42b476616286f7d4abcbce715138ff1aa4"
},
{
"introduced": "d3700f5368dc0b0c51b42adc293c6458766c948b"
},
{
"fixed": "5f3ba237548ca04f8eaf4fa6f94e6dbac562e620"
},
{
"introduced": "4e41d7624d33a28d40e4aff577124189e70acbc3"
},
{
"fixed": "1a59de70ee035a7ff1e8c6d3ab340a372542d4ae"
},
{
"introduced": "7f2e3a7c2755d9906086475b2c89c966a33c48a0"
},
{
"fixed": "65326e42b476616286f7d4abcbce715138ff1aa4"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.43.7.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.44.0"
},
{
"fixed": "0.44.6.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.44.0"
},
{
"fixed": "1.44.6.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.45.0"
},
{
"fixed": "0.45.2.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.45.0"
},
{
"fixed": "1.45.2.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.43.7.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.45.2",
"v0.45.2",
"v1.43.7",
"v0.43.7",
"v1.44.6",
"v0.44.6",
"v1.45.1",
"v0.45.1",
"v1.45.0",
"v0.45.0",
"v1.44.5",
"v0.44.5",
"v1.43.6",
"v0.43.6",
"v1.44.4",
"v0.44.4",
"v1.44.3",
"v0.44.3",
"v1.44.2",
"v0.44.2",
"v1.44.1",
"v0.44.1",
"v1.43.5",
"v0.43.5",
"v1.44.0",
"v0.44.0",
"v1.43.4.2",
"v0.43.4.2",
"v1.43.4.1",
"v0.43.4.1",
"v1.43.4",
"v0.43.4",
"v1.43.3",
"v0.43.3",
"v1.43.2",
"v0.43.2",
"v1.43.1",
"v0.43.1",
"v1.43.0",
"v0.43.0",
"v1.43.0-rc2",
"v0.43.0-rc2",
"v1.43.0-rc1",
"v0.43.0-rc1",
"v1.42.0-rc2",
"v1.42.0-preview1",
"v0.42.0-preview1",
"v1.41.0-RC1",
"v0.41.0-RC1",
"v1.40.0",
"v0.40.0",
"v1.40.0-rc2",
"v0.40.0-rc2",
"v0.40.0-rc1-dan",
"v0.38.0-rc4",
"v0.38.0-rc3",
"v0.38.0-rc2",
"v0.38.0-rc1",
"v0.38.0-preview",
"v0.37.0-rc2",
"v0.36.0-snapshot",
"v0.35.0",
"v0.35.0-rc2",
"v0.35.0-rc1",
"blah",
"0.34.0-rc1",
"v0.26.0.RC1",
"v0.13.0",
"v0.12.0",
"v0.12.0-test",
"v0.11.3",
"v0.11.2",
"v0.11.1",
"v0.10.4.1",
"v0.11.0",
"v0.10.4",
"v0.10.3",
"0.10.3",
"v0.10.0",
"v0.9-final",
"v20150604-alpha",
"v20150603-alpha",
"v20150601-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-23628.json"
}
}
],
"modified": "2026-10-28T02:30:53.368800068Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23628.json",
"https://github.com/metabase/metabase/security/advisories/GHSA-492f-qxr3-9rrv",
"https://nvd.nist.gov/vuln/detail/CVE-2023-23628"
],
"provider_metadata": {
"cwe_ids": [
"CWE-200"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23628.json"
}
},
"related_cves": [
{
"value": "CVE-2023-23628",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 522102,
"published_at": "2023-01-28T01:11:16.71+00:00"
}