GHSA-w6c7-j32f-rq8j

Apache Superset Allows Ownership Takeover

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-27696

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-superset	< 4.1.2	4.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-27696 advisory
https://github.com/apache/superset/commit/fc844d3dfdace890b32c00a507a959b81122b425 web
https://github.com/apache/superset package
https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413 web
http://www.openwall.com/lists/oss-security/2025/05/12/3 web