PYSEC-2026-1163

vendorUSosv

Apache Superset vulnerable to Improper Authorization

view advisory published 2026-07-07Licence: CC-BY-4.0

An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-27525US	medium4.3OT elevated	0.78% (56th)	—	2023-04-17
An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-7jhg-8m74-6f6gADVISORY
https://github.com/apache/supersetPACKAGE
https://lists.apache.org/thread/wpv7b17zjg2pmvpfkdd6nn8sco8y2q77WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-27525ADVISORY
https://pypi.org/project/apache-supersetPACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan