PT-2025-33274 · Apache · Apache Superset

Pedro Sousa · Published 2025-08-13 · Updated 2025-08-18 · CVE-2025-55675

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 5.0.0

Description: Apache Superset contains an improper access control issue in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.

Recommendations: Upgrade to version 5.0.0.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2025-10091

BIT-SUPERSET-2025-55675

CVE-2025-55675

GHSA-MHPQ-M962-MG92

Affected Products

Apache Superset

References · 11

• https://cve.org/CVERecord?id=CVE-2025-55675 · Security Note
• https://osv.dev/vulnerability/GHSA-mhpq-m962-mg92 · Vendor Advisory
• https://lists.apache.org/thread/op681b4kbd7g84tfjf9omz0sxggbcv33 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55675 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10091 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2025-55675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55675 · Security Note
• https://github.com/apache/superset · Note
• http://openwall.com/lists/oss-security/2025/08/14/6 · Note
• https://twitter.com/CVEnew/status/1956021911571292219 · Twitter Post
• https://twitter.com/oss_security/status/1956543483633700886 · Twitter Post