PT-2025-20830 · Apache · Apache Superset

Daniel Gaspar + 1 · CVE-2025-27696 · Published 2025-05-13 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Superset versions through 4.1.1

Description The issue is related to improper authorization, allowing authenticated users with read permissions to take ownership of dashboards, charts, or datasets.

Recommendations For Apache Superset versions through 4.1.1, upgrade to version 4.1.2 or above to fix the issue.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BIT-SUPERSET-2025-27696

CVE-2025-27696

GHSA-W6C7-J32F-RQ8J

PYSEC-2026-1189

Affected Products

Apache Superset

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27696.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-27696 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6c7-j32f-rq8j · Vendor Advisory
• https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27696 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1189 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2025-27696 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/commit/fc844d3dfdace890b32c00a507a959b81122b425 · Note
• https://t.me/cveNotify/134034 · Telegram Post
• http://openwall.com/lists/oss-security/2025/05/12/3 · Note
• https://twitter.com/oss_security/status/1922100253634752537 · Twitter Post
• https://pypi.org/project/apache-superset · Note
• https://github.com/advisories/GHSA-w6c7-j32f-rq8j · Note
• https://t.me/cvenotify/129174 · Telegram Post