Tagged “breach”

Sep 22, 2026

CVE-2026-72898: Metabase Bug Nobody Escalated Hit 1M Users

An unauthenticated SQL injection in Metabase's password-reset endpoint gave attackers admin access — and an unread advisory turned it into a million-record breach.