CVE-2026-25958
High · 7.7CVSS
7.7
EPSS
0.4%
Published
Feb 9, 2026
CISA due date
—
The record
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @cubejs-backend/server-core | 0.27.19 | 1.0.14 |
| npm | @cubejs-backend/server-core | 1.1.0 | 1.4.2 |
| npm | @cubejs-backend/server-core | 1.5.0 | 1.5.13 |
Related vulnerabilities
- GHSA-v226-32c7-x2v7 Cube Core is vulnerable to privilege escalation via a specially crafted request Same vulnerability
- GHSA-9vph-2hvm-x66g Cube Core is vulnerable to Denial of Service (DoS) via crafted request Also affects @cubejs-backend/server-core
- CVE-2026-25957 Cube is a semantic layer for building data applications. Also affects @cubejs-backend/server-core
- CVE-2026-50106 When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root… CWE-807
- CVE-2026-111748 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-807
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-807
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-807
- CVE-2026-87479 Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36… CWE-807