CVE-2026-44718

Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, explorations.replace, and explorations.delete operate on an exploration_id without verifying that the requesting user was a collaborator on the exploration’s database. An authenticated user on the same Mathesar installation who knew or guessed an exploration ID could read, replace, or delete a saved exploration belonging to a database where they were not a collaborator. This affected Mathesar-managed saved exploration definitions, including names, descriptions, selected columns, display metadata, filters, sorting, and transformations. This vulnerability is fixed in 0.10.0.

• CWE-639
• CWE-862

• https://github.com/mathesar-foundation/mathesar/security/advisories/GHSA-wf8r-g5rp-w69f

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44712pam_usb provides hardware authentication for Linux using ord…8.2
• CVE-2026-44713pam_usb provides hardware authentication for Linux using ord…8.8
• CVE-2026-44714The bitcoinj library is a Java implementation of the Bitcoin…7.5
• CVE-2026-44715OpenMRS is an open source electronic medical record system p…8.7
• CVE-2026-44716Pipecat is an open-source Python framework for building real…7.5
• CVE-2026-44717MCP Calculate Server is a mathematical calculation service b…9.8
• CVE-2026-44719Mathesar is a web application that makes working with Postgr…5.3
• CVE-2026-4472A security vulnerability has been detected in itsourcecode O…9.8
• CVE-2026-44720OpenLearnX is an open-source, decentralized learning and ass…6.9
• CVE-2026-44721Open WebUI is a self-hosted artificial intelligence platform…7.3
• CVE-2026-44722pyzipper is a replacement for Python's zipfile that can read…6.2
• CVE-2026-44723Vowpal Wabbit is a machine learning system. The workflow .gi…9.9