Latest / Tech Talks With Kinsoft
Mathspace - 1,079,819 People, a 23-Day Gap, and the Advisory That Never Reached Anyone
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!
Sydney edtech company Mathspace has disclosed a data breach affecting 1,079,819 students, parents and guardians, teachers and staff across Australia and New Zealand. The cause was not an unavailable patch — it was a vulnerability-notification process that never escalated the advisory to anyone who could act.
The flaw: CVE-2026-72898, an unauthenticated SQL injection in Metabase's password reset endpoint, granting administrator access without a valid login. CVSS v3.1 base score 10.0 and…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.