Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-23981 An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to…

Description

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Superset 0.0 0.0.0 → < 6.0.0 6.0.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Superset

Les 65 CVE de Apache Superset →
CVE-2026-23985 A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0 5.3 Moyenne CVE-2026-23969 Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially… 5.3 Moyenne CVE-2026-23980 Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset… 5.3 Moyenne CVE-2026-23982 An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data… 7.1 Élevée
Suivre cette CVE