⚠️CVE-2026-72898 (CVSS 10.0)⚠️
Your Metabase's "forgot password" page will run an attacker's SQL. 😱
No login. No account. An attacker just POSTs to /api/session/reset_password with a crafted user-id — Metabase drops it straight into a database query with zero validation. Full unauthenticated SQL injection: dump admin credentials, session tokens, the whole app DB.
If you self-host Metabase, patch to the latest release now.
🔥PoC + setup: github.com/EQSTLab/CVE-2026-72898
