1 post
Sep 22, 2026
An unauthenticated SQL injection in Metabase's password-reset endpoint gave attackers admin access — and an unread advisory turned it into a million-record breach.
