CVE-2023-49734
mediumpriority · track · 26OT risk · elevatedEPSS 0.009 · 61 %ileDEEUUSEPSS · scored 2026-10-27
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6–7.7
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-3184Apache Superset: Mehrere SchwachstellenDeutsch2023-12-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Denial of Service zu verursachen, Sicherheitseinstellungen zu umgehen und einen SQL-Injection Angriff durchzuführen.
- GHSA-g49j-j489-3xpfApache Superset incorrect write permissions vulnerability2023-12-19ghsa · osvUS
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
- BIT-superset-2023-49734Apache Superset: Privilege Escalation Vulnerability2025-02-05vendor · osvUS
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
- PYSEC-2026-1180Apache Superset incorrect write permissions vulnerability2026-07-07vendor · osvUS
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2023/12/19/3cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-49734/cnnvd
- https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-49734cnnvd
- http://www.openwall.com/lists/oss-security/2023/12/19/3enisa_euvd
- https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5enisa_euvd
- http://www.openwall.com/lists/oss-security/2023/12/19/3Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5Mailing ListVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan