{"uuid": "32ad2992-5e04-43f4-949b-59ab8d776fb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72898", "type": "published-proof-of-concept", "source": "https://t.me/all_free_premium_courses/835", "content": "\u26a0\ufe0fCVE-2026-72898 (CVSS 10.0)\u26a0\ufe0f\n\nYour Metabase's \"forgot password\" page will run an attacker's SQL. \ud83d\ude31\n\nNo login. No account. An attacker just POSTs to /api/session/reset_password with a crafted user-id \u2014 Metabase drops it straight into a database query with zero validation. Full unauthenticated SQL injection: dump admin credentials, session tokens, the whole app DB.\n\nIf you self-host Metabase, patch to the latest release now.\n\n\ud83d\udd25PoC + setup: github.com/EQSTLab/CVE-2026-72898\n\n@all_free_premium_courses", "creation_timestamp": "2026-09-03T13:00:04.363631Z"}