GitHub Advisoryadvisory · PyPI

GHSA-h294-8fxm-m2pj Apache Superset allows authenticated users to view sensitive data without explicit permissions

LOW Published 2026-02-24 Modified 2026-02-26 Official page ↗
Aliases
CVE-2026-23983
Ecosystem
PyPI
Packages
apache-superset
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2026-02-26

Affected packages

• PyPI apache-superset: < 6.0.0 → fixed in 6.0.0

Description

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)

Related

Alias · CVE (1)

  • CVE-2026-23983 A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References