CVE-2026-23982
mediumpriority · track · 26OT risk · elevatedEPSS 0.005 · 44 %ileDEEUUSEPSS · scored 2026-10-27
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0502Apache Superset: Mehrere SchwachstellenDeutsch2026-02-24csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.
- GHSA-3m2g-v7jf-7fxcApache Superset Improper Authorization allows low-privileged users to bypass access controls 2026-02-24ghsa · osvUS
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
- BIT-superset-2026-23982Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass2026-02-26vendor · osvUS
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
- PYSEC-2026-2372Apache Superset Improper Authorization allows low-privileged users to bypass access controls 2026-07-13vendor · osvUS
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/02/24/6cnnvd
- https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fpcnnvd
- https://superset.apache.org/Patchcnnvd
- https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fpenisa_euvd
- http://www.openwall.com/lists/oss-security/2026/02/24/6Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fpMailing ListVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan