Issues on data restriction (Sandbox access)

Hello,

I have created one dashboard with many reports that a great number of users can access. For each group of users I have configured sandbox access to restrict the data that they can consume. One day, two users from different groups claimed to have seen reports with the same data from a third group. Later, I tested the dashboard with mock users from different groups and the same problem happened. However, when I selected one report with wrong data, it ran the query and showed the right data. So I assumed that the application used the cache to show images faster and it ended up consuming cache from another user. So I turned off my cache and, apparently, the problem was solved.

But, my application is slower now and I would like to enable the cache once again without jeopardizing the data restriction.

Thanks

Hi @carolina.castro
Which version are you using? Post "Diagnostic Info" from Admin > Troubleshooting.
There was a problem with cache and sandboxing, which was fixed in 1.37.6:
https://github.com/metabase/metabase/security/advisories/GHSA-6fcp-57cp-fww9