AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-35fc-9hrj-3585

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Apache Superset

CVE-2024-53949 · Published Dec 9, 2024 · updated Jul 7, 2026

High6.5
Fix: upgrade to 4.1.0 or later
GitHub advisory

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.

 issue affects Apache Superset: from 2.0.0 before 4.1.0.

Users are recommended to upgrade to version 4.1.0, which fixes the issue.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
>= 2.0.0, < 4.1.04.1.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-285, CWE-863
Also known as
BIT-superset-2024-53949, CVE-2024-53949, PYSEC-2026-1156

More Apache Superset advisories

All Apache Superset
Medium 8.8May 13, 2025Apache Superset Allows Ownership TakeoverCVE-2025-27696fixed in 4.1.2High 6.5Dec 12, 2024Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633fixed in 4.1.0Medium 5.3Dec 9, 2024Apache Superset: Error verbosity exposes metadata in analytics databasesCVE-2024-53948fixed in 4.1.0Low 9.8Dec 9, 2024Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsCVE-2024-53947fixed in 4.1.0Medium 4.3Jul 16, 2024Apache Superset vulnerable to improper SQL authorizationCVE-2024-39887fixed in 4.0.2Medium 6.8Jun 20, 2024Apache Superset server arbitrary file readCVE-2024-34693fixed in 3.1.3 +1