BIT-superset-2025-27696

vendorUSosv

Apache Superset: Incorrect authorization leading to resource ownership takeover

view advisory published 2025-05-16Licence: per source

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-27696US	high8.8OT elevated	1.30% (70th)	—	2025-05-13
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affec…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/05/12/3ADVISORY
https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-27696WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan