PT-2024-21277 · Apache · Apache Superset

Matt Freyre · CVE-2024-26016 · Published 2024-02-28 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0

Description A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.

Recommendations For Apache Superset versions prior to 3.0.4, upgrade to version 3.1.1. For Apache Superset versions 3.1.0, upgrade to version 3.1.1.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SUPERSET-2024-26016

CVE-2024-26016

GHSA-3V9R-885J-762G

PYSEC-2026-1158

Affected Products

Apache Superset

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26016.json · Exploit
• https://lists.apache.org/thread/76v1jjcylgk4p3m0258qr359ook3vl8s · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2024-26016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26016 · Security Note
• https://osv.dev/vulnerability/GHSA-3v9r-885j-762g · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1158 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26016 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://twitter.com/CVEnew/status/1762847254426120245 · Twitter Post
• https://pypi.org/project/apache-superset · Note
• https://twitter.com/oss_security/status/1762845720996884931 · Twitter Post
• https://t.me/cvenotify/72547 · Telegram Post
• https://twitter.com/dailycve/status/1874148572985442453 · Twitter Post
• http://openwall.com/lists/oss-security/2024/02/28/7 · Note
• https://github.com/advisories/GHSA-3v9r-885j-762g · Note