One Million Records Down The SQL Drain

Mathspace leaked data for a million users through a classic Metabase SQL injection flaw. Truly delightful to see nineties database errors thriving in modern edtech.

Source: Insurance Business

The Full Story

Severity: Critical Mood: Expected

Same story, different day, as over a million students, teachers, and parents discover Mathspace left an unauthenticated CVSS 10.0 SQL injection flaw wide open in their self-hosted Metabase instance. To protect ourselves from this catastrophe, one would hope organisations might actually secure their self-hosted Metabase software against CVE-2026-72898 before miscreants stroll through the front door. Instead, we are treated to the thrilling spectacle of regulatory notifications being dutifully dispatched to commissioners across Australia and New Zealand.

#ClassicSQLi #OhLookABreach

Open article →