Mathspace Left a CVSS 10 Bug Unpatched. 1 Million Records Walked Out

• The Mess: Mathspace left a critical Metabase vulnerability unpatched for 23 days. Attackers used it to break into the company’s internal reporting system and access data tied to 1,079,819 people.
• The Damage: Names, email addresses, usernames, time zones and login-related data were exposed across Australia and New Zealand.
• The Fix: Patch Metabase immediately, rotate connected database credentials, revoke sessions and investigate logs for signs of compromise.

The vulnerability was CVE-2026-72898, a pre-authentication SQL injection in Metabase rated CVSS 10.0.

The bug did not require an account. An attacker could abuse the password-reset functionality and inject SQL into the Metabase application database. Successful exploitation could create an authenticated session with administrator privileges.

From there, the attack stops being a simple SQL injection.

Metabase’s own investigation says the attacker could use the forged session to browse data and create an API key capable of bulk downloads. Connected database credentials could also be exposed, depending on the deployment.

That is exactly what made the Mathspace incident ugly.

23 Days Was Enough

Metabase published its security warning on August 6 and released patched versions the same day. The company was already dealing with active exploitation of the vulnerability in the wild.

Mathspace’s internal vulnerability-notification process failed to escalate the advisory.

The company eventually patched its self-hosted Metabase installation on August 29.

Attackers got in on August 10.

Data was downloaded through August 27.

The gap was not theoretical. It became an intrusion window.

Mathspace later confirmed that the attackers accessed its internal reporting environment and downloaded information belonging to more than one million users. The exposed records included names, email addresses, usernames and other account metadata. Passwords, financial information and academic records were not reported as exposed.

The Bug Was Worse Than “SQL Injection”

The interesting part of CVE-2026-72898 is the attack chain.

The vulnerable password-reset endpoint accepted attacker-controlled parameters. Metabase’s investigation found that the attacker could manipulate the request so that SQL was injected into the application database.

The attacker could then insert a session associated with the first user account — normally the administrator account created during initial setup.

That session provided authenticated access without knowing the administrator’s password.

The attacker could then move from application compromise to data extraction.

Metabase observed attack traffic including a request to the password-reset endpoint followed by a successful request to identify the current user.

This is why treating the incident as “just an SQLi” misses the point.

The SQL injection was the front door.

The session forgery was the key.

The API access was the data-exfiltration mechanism.

Mathspace Was Not the Only One

Metabase disclosed that the August campaign affected some self-hosted installations and that less than 3% of its cloud customers were compromised before mitigation. Security researchers also found thousands of potentially vulnerable self-hosted instances exposed to the internet.

The problem therefore extends beyond one education platform.

If an organization runs Metabase itself and exposes the application to the internet, CVE-2026-72898 should be treated as an incident-response problem if patching happened late — not merely as a version-management task.

Upgrading closes the vulnerability.

It does not tell you whether somebody already exploited it.

What Defenders Should Check

Metabase recommends several post-compromise actions:

• revoke active sessions;
• review administrator accounts;
• remove unexpected API keys;
• rotate credentials for connected databases;
• inspect data warehouse logs;
• review Metabase activity and query history;
• search application and ingress logs for suspicious password-reset activity.

Metabase has also released hardened versions beyond the original fixes, raising the minimum safe releases across supported branches.

For organizations that exposed Metabase during the vulnerable period, “we patched it” is not an adequate incident report.

The question is what happened before the patch.

Bugstoday Opinion

Mathspace did not lose data because CVE-2026-72898 was particularly subtle.

It lost data because a CVSS 10.0, actively exploited vulnerability sat in the patch queue.

That is the part defenders should remember.

A critical vulnerability with a patch is not a future problem. It is a countdown.

And 23 days was more than enough time for someone to start downloading the database.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

• Metabase — Security Update, August 6, 2026
• Metabase — August 2026 Security Vulnerability: What Happened?
• Metabase — Security-Focused Release Announcement
• Mathspace — Data Breach Disclosure
• CVE-2026-72898 / CISA KEV