CVE-2026-25958highCWE-807

CVE-2026-25958: high-severity vulnerability in cube-js cube

Cube privilege escalation via a specially crafted request

Published · Updated

Follow this CVE+ Monitor cube.js+ Monitor @cubejs-backend/server-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.4%
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
cube-js · cube
Related CVEs — cube-js cube

In the same product, most dangerous first.

CVE-2023-50709MEDIUMDenial of service attack on the cube-api endpointEPSS 0.7%CVE-2026-25957MEDIUMCube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted requestEPSS 0.4%