2026 Dodo Payments — Metabase CVE-2026-72898; internal analytics accessed; merchant reporting data involved

Verified company notice — August 16–20, 2026. Dodo Payments (global merchant-of-record / payments platform) detected unauthorised access on August 16, 2026 to a self-hosted Metabase deployment used only for internal business analytics, separate from payment authorisation, settlement, and cardholder data environments. Co-founders published on LinkedIn August 17; the company blog (updated August 20) states attackers exploited CVE-2026-72898 (critical Metabase SQL injection / authentication bypass, GHSA-vwf4-m7j8-wcjf) without any Dodo Payments credential, contained access within hours, upgraded Metabase, revoked sessions/tokens/keys, and preserved forensic evidence. Dodo says payment processing, merchant funds, full card numbers, API keys, dashboard passwords, and PCI DSS Level 1 posture were not affected and no services were disrupted. The notice acknowledges information relating to some merchants was involved via reporting datasets viewed/queried during a short bounded window; affected merchants will be contacted directly and [email protected] is offered for inquiries — no nationwide census at indexing. Ransomware.live indexed a DireWolf leak-site listing for DodoPayments discovered August 15, 2026 (financial-software sector); the company had not confirmed ransomware encryption or a public data dump at indexing and characterised impact as limited to the Metabase reporting system. recordsAffected 0 pending merchant/individual notice counts; companyConfirmed true.