~ / search / GHSA-8w7f-8pr9-xgwj

GHSA-8w7f-8pr9-xgwj

Apache Superset: Improper authorization bypass on row level security via SQL Injection

Source: GitHub Advisory Database (reviewed) High CVE-2025-48912

Packages

EcosystemPackageAffectedFixed in
PyPI apache-superset < 4.1.2 4.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.