CVE-2026-25958

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25958
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25958.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25958
Aliases
Published
2026-02-09T22:42:54.404Z
Modified
2026-07-15T01:49:01.581860905Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Cube privilege escalation via a specially crafted request
Details

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25958.json",
    "cwe_ids": [
        "CWE-807"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/cube-js/cube

Affected ranges

Type
GIT
Repo
https://github.com/cube-js/cube
Events
Introduced
e073a4a3197e5d81cf8d7df56e952caac4fa9da4
Fixed
5a5adc9c0f74eb768c36cb70cfce7c835ead54e9
Introduced
15f5a123e81be296765de54394d49fe3306f52da
Fixed
4e47fc6ca2fe0bb4b921e64448c647b3c0a8707a
Introduced
e4d767eee86887aab47bfcb6448d9db2bf0851cc
Fixed
7a2b4a0b705f61863d35102099ecc29be198ab6a
Database specific 
{
    "cpe": "cpe:2.3:a:cube:cube.js:*:*:*:*:*:node.js:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0.27.19"
        },
        {
            "fixed": "1.0.14"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "1.4.2"
        },
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "1.5.13"
        }
    ]
}

Affected versions

v0.*
v0.27.19
v0.27.20
v0.27.21
v0.27.22
v0.27.23
v0.27.24
v0.27.25
v0.27.26
v0.27.27
v0.27.29
v0.27.30
v0.27.31
v0.27.32
v0.27.33
v0.27.34
v0.27.35
v0.27.36
v0.27.37
v0.27.38
v0.27.39
v0.27.40
v0.27.41
v0.27.42
v0.27.43
v0.27.44
v0.27.45
v0.27.46
v0.27.47
v0.27.48
v0.27.49
v0.27.50
v0.27.51
v0.27.52
v0.27.53
v0.28.0
v0.28.1
v0.28.10
v0.28.11
v0.28.12
v0.28.13
v0.28.14
v0.28.15
v0.28.16
v0.28.17
v0.28.18
v0.28.19
v0.28.2
v0.28.20
v0.28.21
v0.28.22
v0.28.23
v0.28.24
v0.28.25
v0.28.26
v0.28.27
v0.28.28
v0.28.29
v0.28.3
v0.28.30
v0.28.31
v0.28.32
v0.28.33
v0.28.34
v0.28.35
v0.28.36
v0.28.37
v0.28.38
v0.28.39
v0.28.4
v0.28.40
v0.28.41
v0.28.42
v0.28.43
v0.28.44
v0.28.45
v0.28.46
v0.28.47
v0.28.48
v0.28.49
v0.28.5
v0.28.50
v0.28.51
v0.28.52
v0.28.53
v0.28.54
v0.28.55
v0.28.56
v0.28.57
v0.28.58
v0.28.59
v0.28.6
v0.28.60
v0.28.61
v0.28.62
v0.28.63
v0.28.64
v0.28.65
v0.28.66
v0.28.67
v0.28.7
v0.28.8
v0.28.9
v0.29.0
v0.29.1
v0.29.10
v0.29.11
v0.29.12
v0.29.12-1
v0.29.13
v0.29.14
v0.29.15
v0.29.16
v0.29.17
v0.29.18
v0.29.19
v0.29.2
v0.29.20
v0.29.21
v0.29.22
v0.29.23
v0.29.24
v0.29.25
v0.29.26
v0.29.27
v0.29.28
v0.29.29
v0.29.3
v0.29.30
v0.29.31
v0.29.32
v0.29.33
v0.29.34
v0.29.35
v0.29.36
v0.29.37
v0.29.38
v0.29.39
v0.29.4
v0.29.40
v0.29.41
v0.29.42
v0.29.43
v0.29.44
v0.29.45
v0.29.46
v0.29.47
v0.29.48
v0.29.49
v0.29.5
v0.29.50
v0.29.51
v0.29.52
v0.29.53
v0.29.54
v0.29.55
v0.29.56
v0.29.57
v0.29.6
v0.29.7
v0.29.8
v0.29.9
v0.30.0
v0.30.1
v0.30.10
v0.30.11
v0.30.12
v0.30.13
v0.30.14
v0.30.15
v0.30.16
v0.30.17
v0.30.18
v0.30.19
v0.30.2
v0.30.20
v0.30.21
v0.30.22
v0.30.23
v0.30.24
v0.30.25
v0.30.26
v0.30.27
v0.30.28
v0.30.29
v0.30.3
v0.30.30
v0.30.31
v0.30.32
v0.30.33
v0.30.34
v0.30.35
v0.30.36
v0.30.37
v0.30.38
v0.30.39
v0.30.4
v0.30.40
v0.30.41
v0.30.42
v0.30.43
v0.30.44
v0.30.45
v0.30.46
v0.30.47
v0.30.48
v0.30.49
v0.30.5
v0.30.50
v0.30.51
v0.30.52
v0.30.53
v0.30.54
v0.30.55
v0.30.56
v0.30.57
v0.30.58
v0.30.59
v0.30.6
v0.30.60
v0.30.61
v0.30.62
v0.30.63
v0.30.64
v0.30.65
v0.30.66
v0.30.67
v0.30.68
v0.30.69
v0.30.7
v0.30.70
v0.30.71
v0.30.72
v0.30.73
v0.30.74
v0.30.75
v0.30.8
v0.30.9
v0.31.0
v0.31.1
v0.31.10
v0.31.11
v0.31.12
v0.31.13
v0.31.14
v0.31.15
v0.31.16
v0.31.17
v0.31.18
v0.31.19
v0.31.2
v0.31.20
v0.31.21
v0.31.22
v0.31.23
v0.31.24
v0.31.25
v0.31.26
v0.31.27
v0.31.28
v0.31.29
v0.31.3
v0.31.30
v0.31.31
v0.31.32
v0.31.33
v0.31.34
v0.31.35
v0.31.36
v0.31.37
v0.31.38
v0.31.39
v0.31.4
v0.31.40
v0.31.41
v0.31.42
v0.31.43
v0.31.44
v0.31.45
v0.31.46
v0.31.47
v0.31.48
v0.31.49
v0.31.5
v0.31.50
v0.31.51
v0.31.52
v0.31.53
v0.31.54
v0.31.55
v0.31.56
v0.31.57
v0.31.58
v0.31.59
v0.31.6
v0.31.60
v0.31.61
v0.31.62
v0.31.63
v0.31.64
v0.31.65
v0.31.66
v0.31.67
v0.31.68
v0.31.69
v0.31.7
v0.31.8
v0.31.9
v0.32.0
v0.32.1
v0.32.10
v0.32.11
v0.32.12
v0.32.13
v0.32.14
v0.32.15
v0.32.16
v0.32.17
v0.32.18
v0.32.19
v0.32.2
v0.32.20
v0.32.21
v0.32.22
v0.32.23
v0.32.24
v0.32.25
v0.32.26
v0.32.27
v0.32.28
v0.32.29
v0.32.3
v0.32.30
v0.32.31
v0.32.4
v0.32.5
v0.32.6
v0.32.7
v0.32.8
v0.32.9
v0.33.0
v0.33.1
v0.33.10
v0.33.11
v0.33.12
v0.33.13
v0.33.14
v0.33.15
v0.33.16
v0.33.17
v0.33.18
v0.33.19
v0.33.2
v0.33.20
v0.33.21
v0.33.22
v0.33.23
v0.33.24
v0.33.25
v0.33.26
v0.33.27
v0.33.28
v0.33.29
v0.33.3
v0.33.30
v0.33.31
v0.33.32
v0.33.33
v0.33.34
v0.33.35
v0.33.36
v0.33.37
v0.33.38
v0.33.39
v0.33.4
v0.33.40
v0.33.41
v0.33.42
v0.33.43
v0.33.44
v0.33.45
v0.33.46
v0.33.47
v0.33.48
v0.33.49
v0.33.5
v0.33.50
v0.33.51
v0.33.52
v0.33.53
v0.33.54
v0.33.55
v0.33.56
v0.33.57
v0.33.58
v0.33.59
v0.33.6
v0.33.60
v0.33.61
v0.33.62
v0.33.63
v0.33.64
v0.33.65
v0.33.7
v0.33.8
v0.33.9
v0.34.0
v0.34.1
v0.34.10
v0.34.11
v0.34.12
v0.34.13
v0.34.14
v0.34.15
v0.34.16
v0.34.17
v0.34.18
v0.34.19
v0.34.2
v0.34.20
v0.34.21
v0.34.22
v0.34.23
v0.34.24
v0.34.25
v0.34.26
v0.34.27
v0.34.28
v0.34.29
v0.34.3
v0.34.30
v0.34.31
v0.34.32
v0.34.33
v0.34.34
v0.34.35
v0.34.36
v0.34.37
v0.34.38
v0.34.39
v0.34.4
v0.34.40
v0.34.41
v0.34.42
v0.34.43
v0.34.44
v0.34.45
v0.34.46
v0.34.47
v0.34.48
v0.34.49
v0.34.5
v0.34.50
v0.34.51
v0.34.52
v0.34.53
v0.34.54
v0.34.55
v0.34.56
v0.34.57
v0.34.58
v0.34.59
v0.34.6
v0.34.60
v0.34.61
v0.34.62
v0.34.7
v0.34.8
v0.34.9
v0.35.0
v0.35.1
v0.35.10
v0.35.11
v0.35.12
v0.35.13
v0.35.14
v0.35.15
v0.35.16
v0.35.17
v0.35.18
v0.35.19
v0.35.2
v0.35.20
v0.35.21
v0.35.22
v0.35.23
v0.35.24
v0.35.25
v0.35.26
v0.35.27
v0.35.28
v0.35.29
v0.35.3
v0.35.30
v0.35.31
v0.35.32
v0.35.33
v0.35.34
v0.35.35
v0.35.36
v0.35.37
v0.35.38
v0.35.39
v0.35.4
v0.35.40
v0.35.41
v0.35.42
v0.35.43
v0.35.44
v0.35.45
v0.35.46
v0.35.47
v0.35.48
v0.35.49
v0.35.5
v0.35.50
v0.35.51
v0.35.52
v0.35.53
v0.35.54
v0.35.55
v0.35.56
v0.35.57
v0.35.58
v0.35.59
v0.35.6
v0.35.60
v0.35.61
v0.35.62
v0.35.63
v0.35.64
v0.35.65
v0.35.66
v0.35.67
v0.35.68
v0.35.69
v0.35.7
v0.35.70
v0.35.71
v0.35.72
v0.35.73
v0.35.74
v0.35.75
v0.35.76
v0.35.77
v0.35.78
v0.35.79
v0.35.8
v0.35.80
v0.35.81
v0.35.9
v0.36.0
v0.36.1
v0.36.10
v0.36.11
v0.36.2
v0.36.3
v0.36.4
v0.36.5
v0.36.6
v0.36.7
v0.36.8
v0.36.9
v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.25
v1.2.26
v1.2.27
v1.2.28
v1.2.29
v1.2.3
v1.2.30
v1.2.31
v1.2.32
v1.2.33
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.10
v1.3.11
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.17
v1.3.18
v1.3.19
v1.3.2
v1.3.20
v1.3.21
v1.3.22
v1.3.23
v1.3.24
v1.3.25
v1.3.26
v1.3.27
v1.3.28
v1.3.29
v1.3.3
v1.3.30
v1.3.31
v1.3.32
v1.3.33
v1.3.34
v1.3.35
v1.3.36
v1.3.37
v1.3.38
v1.3.39
v1.3.4
v1.3.40
v1.3.41
v1.3.42
v1.3.43
v1.3.44
v1.3.45
v1.3.46
v1.3.47
v1.3.48
v1.3.49
v1.3.5
v1.3.50
v1.3.51
v1.3.52
v1.3.53
v1.3.54
v1.3.55
v1.3.56
v1.3.57
v1.3.58
v1.3.59
v1.3.6
v1.3.60
v1.3.61
v1.3.62
v1.3.63
v1.3.64
v1.3.65
v1.3.66
v1.3.67
v1.3.68
v1.3.69
v1.3.7
v1.3.70
v1.3.71
v1.3.72
v1.3.73
v1.3.74
v1.3.75
v1.3.76
v1.3.77
v1.3.78
v1.3.79
v1.3.8
v1.3.80
v1.3.81
v1.3.82
v1.3.83
v1.3.84
v1.3.85
v1.3.86
v1.3.9
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.10
v1.5.11
v1.5.12
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25958.json"