Dashboard Update Response Leaks Card Details from Restricted Collections

Summary

An authenticated user with write access to a dashboard can retrieve the full details of cards embedded on that dashboard, even when those cards live in collections the user cannot otherwise access.

Details

The GET /api/dashboard/:id handler runs each embedded dashcard through a permission filter that hides cards the current user cannot read, returning only a minimal three-field projection (id, query_average_duration, download_perms) for restricted cards. The PUT /api/dashboard/:id response rehydrates dashcards through the same card pipeline but doesn’t apply the same filter, so the response body includes the full card object for every dashcard, including cards whose owning collection is invisible to the requester.

The leaked card fields include:

• The card's native SQL query
• Target database ID
• Collection ID
• Creator
• Result metadata (column names and types, but not actual results)

Any PUT on the dashboard (including a no-op such as setting the name to its current value) triggers the leak, so the precondition is only write permission on the dashboard itself. The user still cannot fetch the restricted card directly or execute it; the exposure is limited to the card definition and metadata returned in the PUT response body.

Patches

The fix is available in the following versions and above:

• 1.58.14, 0.58.14
• 1.59.7, 0.59.7
• 1.60.1, 0.60.1

Credit

Jeroen Gui (@jeroengui)