cve.bz

CVE-2026-25958

7.7 highEPSS 0.4%

High (7.7) in cube cube.js. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in @cubejs-backend/server-core 1.0.14, 1.4.2, 1.5.13.

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.

Severity

CVSS 3.1

7.7 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE
CWE-807
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v226-32c7-x2v7npm@cubejs-backend/server-core>=0.27.19 <1.0.141.0.14
GHSA-v226-32c7-x2v7npm@cubejs-backend/server-core>=1.1.0 <1.4.21.4.2
GHSA-v226-32c7-x2v7npm@cubejs-backend/server-core>=1.5.0 <1.5.131.5.13

References

Check your stackJSON