PT-2026-21680 · Apache · Apache Superset

Daniel Gaspar + 1 · Published 2026-02-24 · Updated 2026-02-28 · CVE-2026-23982

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description An improper authorization issue exists in Apache Superset that allows a low-privileged user to bypass data access controls. Specifically, an authenticated attacker with permissions to write datasets and read charts can bypass permission checks by overwriting the SQL query of an existing dataset when creating a dataset. This allows unauthorized data access.

Recommendations Upgrade to version 6.0.0 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SUPERSET-2026-23982

CVE-2026-23982

GHSA-3M2G-V7JF-7FXC

Affected Products

Apache Superset

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-23982 · Security Note
• https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23982 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3m2g-v7jf-7fxc · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2026-23982 · Vendor Advisory
• https://github.com/apache/superset · Note
• http://openwall.com/lists/oss-security/2026/02/24/6 · Note
• https://twitter.com/CVEnew/status/2027841534356541603 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027842681137696962 · Twitter Post
• https://twitter.com/oss_security/status/2026525907813306789 · Twitter Post