GHSA-748r-5r8q-273m
Apache Superset allows authenticated users to access metadata they have no permission to
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | apache-superset | < 1.5.1 | 1.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
References
External links from the advisory. They lead to third-party sites.