CVE-2026-25958

Description

### **Impact** It is possible to make a specially crafted request with a valid API token that leads to privilege escalation. ### Affected Versions: `≥= 0.27.19` ### Mitigation: Upgrade to a patched version: - 1.5.13 and later (regular release) - 1.4.2 (active [LTS release](https://cube.dev/docs/product/administration/distribution#long-term-support)) - 1.0.14 (end-of-life LTS release) ### **References** The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

Affected packages (1)

• npm/@cubejs-backend/server-core>= 0.27.19, < 1.0.14

CVSS scores

References (3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-25958
• PATCHhttps://github.com/cube-js/cube
• WEBhttps://github.com/cube-js/cube/security/advisories/GHSA-v226-32c7-x2v7