Mathesar Missing Database Authorization Vulnerability Allowing Unauthorized Metadata Access

A vulnerability in Mathesar versions 0.2.0 prior to 0.10.0 allows authenticated users to access database-specific metadata without proper authorization. The issue arises in several RPC methods that accept a database ID without verifying if the user is a collaborator. This flaw could lead to unauthorized exposure of collaborator mappings, table metadata, saved exploration metadata, and form metadata, including sensitive form tokens for public forms, which could be used to submit responses under certain PostgreSQL roles.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive database metadata, including collaborator information, form tokens for public forms, and other Mathesar-managed data, depending on the features in use.

Remediation

Users are advised to upgrade to Mathesar version 0.10.0 or later. For deployments where all Mathesar users are mutually trusted, the vulnerability exposure is reduced.