GitHub Advisoryadvisory · PyPI

GHSA-3m2g-v7jf-7fxc Apache Superset Improper Authorization allows low-privileged users to bypass access controls

HIGH Published 2026-02-24 Modified 2026-02-26 Official page ↗
Aliases
CVE-2026-23982
Ecosystem
PyPI
Packages
apache-superset
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2026-02-26

Affected packages

• PyPI apache-superset: < 6.0.0 → fixed in 6.0.0

Description

An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-23982 An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References