GHSA-v226-32c7-x2v7HighCVSS 7.7

Cube Core is vulnerable to privilege escalation via a specially crafted request

Published
February 10, 2026
Last Modified
February 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-25958 →

📋 Description

Impact

It is possible to make a specially crafted request with a valid API token that leads to privilege escalation.

Affected Versions:

≥= 0.27.19

Mitigation:

Upgrade to a patched version:

  • 1.5.13 and later (regular release)
  • 1.4.2 (active LTS release)
  • 1.0.14 (end-of-life LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

🎯 Affected products3

  • npm/@cubejs-backend/server-core:>= 0.27.19, < 1.0.14
  • npm/@cubejs-backend/server-core:>= 1.1.0, < 1.4.2
  • npm/@cubejs-backend/server-core:>= 1.5.0, < 1.5.13

🔗 References (3)