CVE-2023-23628 Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor

Medium 5.7 Published 28 Jan 2023 Updated 10 Mar 2025

Sandboxed users can view recipient lists for dashboard subscriptions, exposing sensitive user information to unauthorized actors.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-23628?

CVE-2023-23628 is a medium-severity vulnerability in metabase, published on 28 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the sandboxed user is able to view the list of recipients for that subscription. This issue is patched in versions 0.43.7.1, 1.43.7.1, 0.44.6.1, 1.44.6.1, 0.45.2.1, and 1.45.2.1. There are no workarounds.

Weakness: CWE-200

Which versions are affected by CVE-2023-23628?

It affects 1 product.

Products include Metabase Metabase.

How do I fix CVE-2023-23628?

No fix has been published for CVE-2023-23628 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-23628 being exploited?

There is no known exploitation of CVE-2023-23628 in the wild and no public exploit code.

Sources

Also known as GHSA-492f-qxr3-9rrv.