PYSEC-2026-1168

vendorUSosv

Apache Superset has improper default REST API permission for Gamma users

view advisory published 2026-07-07Licence: CC-BY-4.0

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-36387US	medium5.4OT elevated	1.13% (66th)	—	2023-09-06
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-9832-mgg4-3gr6ADVISORY
https://github.com/apache/supersetPACKAGE
https://github.com/apache/superset/pull/24185WEB
https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-36387ADVISORY
https://pypi.org/project/apache-supersetPACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan