Home

Description

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.

PUBLISHED Reserved 2026-02-09 | Published 2026-02-09 | Updated 2026-02-11 | Assigner GitHub_M




HIGH: 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Problem types

CWE-807: Reliance on Untrusted Inputs in a Security Decision

Product status

>= 0.27.19, < 1.0.14
affected

>= 1.1.0, < 1.4.2
affected

>= 1.5.0, < 1.5.13
affected

References

github.com/...s/cube/security/advisories/GHSA-v226-32c7-x2v7

cve.org (CVE-2026-25958)

nvd.nist.gov (CVE-2026-25958)

Download JSON