CVE-2026-44718 Mathesar: Missing collaborator checks allowed access to saved explorations in other databases
An authenticated user can read, modify, or delete saved explorations in other databases due to missing collaborator checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44718?
CVE-2026-44718 is a medium-severity missing authorization vulnerability in mathesar-foundation mathesar, published on 15 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, explorations.replace, and explorations.delete operate on an exploration_id without verifying that the requesting user was a collaborator on the exploration’s database. An authenticated user on the same Mathesar installation who knew or guessed an exploration ID could read, replace, or delete a saved exploration belonging to a database where they were not a collaborator. This affected Mathesar-managed saved exploration definitions, including names, descriptions, selected columns, display metadata, filters, sorting, and transformations. This vulnerability is fixed in 0.10.0.
Which versions are affected by CVE-2026-44718?
How do I fix CVE-2026-44718?
No fix has been published for CVE-2026-44718 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44718 being exploited?
There is no known exploitation of CVE-2026-44718 in the wild and no public exploit code.
Sources
Also known as GHSA-wf8r-g5rp-w69f.