CVE-2026-23982
mediumPriorität · verfolgen · 26OT-Risiko · erhöhtEPSS 0.005 · 44. PerzentilDEEUUSEPSS · bewertet 2026-10-27
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.9–7.1
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (8)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-0502Apache Superset: Mehrere SchwachstellenDeutsch2026-02-24csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.
- GHSA-3m2g-v7jf-7fxcApache Superset Improper Authorization allows low-privileged users to bypass access controls 2026-02-24ghsa · osvUS
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
- BIT-superset-2026-23982Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass2026-02-26vendor · osvUS
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
- PYSEC-2026-2372Apache Superset Improper Authorization allows low-privileged users to bypass access controls 2026-07-13vendor · osvUS
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2026/02/24/6cnnvd
- https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fpcnnvd
- https://superset.apache.org/Patchcnnvd
- https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fpenisa_euvd
- http://www.openwall.com/lists/oss-security/2026/02/24/6Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fpMailing ListVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan