GitHub Advisoryadvisory · PyPI

GHSA-3v9r-885j-762g Apache Superset: Improper authorization validation on dashboards and charts import

MEDIUM Published 2024-02-28 Modified 2025-02-13 Official page ↗
Aliases
CVE-2024-26016
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2024-02-28

Affected packages

• PyPI apache-superset: < 3.0.4 → fixed in 3.0.4 • PyPI apache-superset: >= 3.1.0, < 3.1.1 → fixed in 3.1.1

Description

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-26016 A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References