An authenticated information disclosure vulnerability in Metabase allows low-privileged users to retrieve sensitive database credentials via manipulated template notifications.

This vulnerability involves improper neutralization of special elements used in a template engine (CWE-1336), which allows an authenticated user to perform code injection (CWE-94). By leveraging template evaluation, an attacker with low-level privileges can force the application to include sensitive internal credentials within outgoing email notifications.

Successful exploitation of this flaw poses a severe risk to data confidentiality, as it grants attackers access to database credentials. With these credentials, an attacker could potentially bypass application-level controls to perform unauthorized data exfiltration or modify information stored in backend databases. The CVSS score of 7.7 reflects the high impact on confidentiality and the potential for lateral movement within the network environment.

Immediate Action: Upgrade to Metabase version 0.57.13 or 0.58.7 immediately to incorporate the provided security fixes.

Proactive Monitoring: Review system logs for unusual email notification patterns or unauthorized access attempts to administrative endpoints by low-privileged accounts.

Compensating Controls: If patching is not immediately feasible, disable the notification feature in the Metabase instance to block access to the vulnerable endpoints used for template evaluation.

Public Exploit Available: Unknown

Given the ability for authenticated users to escalate their access by obtaining database credentials, this vulnerability should be treated as a high priority. Administrators must prioritize the application of the vendor patches to close the vulnerable template evaluation path. If immediate patching is delayed, disabling notification functionality is a necessary temporary measure to prevent potential credential theft.