A high-severity privilege escalation vulnerability in Cube allows authenticated users to bypass security controls and gain unauthorized access to data.

This flaw involves a reliance on untrusted inputs during security decisions (CWE-807). An attacker with a valid API token can manipulate requests to escalate privileges within the application.

The ability for an authenticated user to escalate privileges poses a significant threat to data confidentiality. Because Cube operates as a semantic layer for data applications, successful exploitation could lead to unauthorized access to sensitive business intelligence, financial data, or customer records. The CVSS score of 7.7 reflects the high impact on confidentiality in a networked environment, necessitating prompt remediation to prevent internal data exposure.

Immediate Action: Update the @cubejs-backend/server-core package to version 1.0.14, 1.4.2, or 1.5.13 immediately to apply the vendor-supplied security patches.

Proactive Monitoring: Audit API access logs for anomalous request patterns or unexpected privilege changes associated with standard user tokens.

Compensating Controls: Implement strict API token management and consider utilizing a Web Application Firewall (WAF) to filter requests that deviate from standard structural expectations.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized data access through privilege escalation, this vulnerability should be prioritized for patching within the next standard update cycle. Administrators must verify their current version of the @cubejs-backend/server-core package and upgrade to the specified fixed versions to eliminate the risk of unauthorized privilege escalation by authenticated users.