PT-2026-21680 · Apache · Apache Superset

Daniel Gaspar + 1 · Publicado 2026-02-24 · Atualizado 2026-02-28 · CVE-2026-23982

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description An improper authorization issue exists in Apache Superset that allows a low-privileged user to bypass data access controls. Specifically, an authenticated attacker with permissions to write datasets and read charts can bypass permission checks by overwriting the SQL query of an existing dataset when creating a dataset. This allows unauthorized data access.

Recommendations Upgrade to version 6.0.0 to resolve the issue.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-SUPERSET-2026-23982

CVE-2026-23982

GHSA-3M2G-V7JF-7FXC

Produtos afetados

Apache Superset

Referências · 10

• https://github.com/apache/superset · Nota
• http://openwall.com/lists/oss-security/2026/02/24/6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-23982 · Nota de Segurança
• https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fp · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027841534356541603 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23982 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3m2g-v7jf-7fxc · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2027842681137696962 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-superset-2026-23982 · Aviso do Fabricante
• https://twitter.com/oss_security/status/2026525907813306789 · Publicação no Twitter