GHSA-8f5j-mgx9-5hm5
Apache Superset has Improper Access Control
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | apache-superset | <= 1.5.2 | no fix listed |
| PyPI | apache-superset | 2.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
When explicitly enabling the feature flag `DASHBOARD_CACHE` (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
References
External links from the advisory. They lead to third-party sites.