Home

Description

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

PUBLISHED Reserved 2025-03-05 | Published 2025-05-13 | Updated 2025-09-01 | Assigner apache




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-863 Incorrect Authorization

Product status

Default status
unaffected

Any version
affected

Credits

João Marono finder

Daniel Gaspar remediation developer

References

www.openwall.com/lists/oss-security/2025/05/12/3

lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413 vendor-advisory

cve.org (CVE-2025-27696)

nvd.nist.gov (CVE-2025-27696)

Download JSON