Summary by Settle Vulnerability Disclosure Program
Fixed in October 2026. The Metabase embed token and the affected business fields now check the caller's role server-side.
GraphQL read resolvers and Metabase embed endpoint return full business data to Viewer role
Disclosed by Albinj- Engagement Settle Vulnerability Disclosure Program
- Disclosed date 15 days ago
- Priority P4 Bugcrowd's VRT priority rating
- Status Resolved This vulnerability has been accepted and fixed
Summary by Albinj
Viewer-role users could read business data through GraphQL read resolvers and the Metabase embed endpoint without role permission checks.