AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-748r-5r8q-273m

Apache Superset allows authenticated users to access metadata they have no permission to

Apache Superset

CVE-2021-37839 · Published Jul 7, 2022 · updated Jul 7, 2026

Medium4.3
Fix: upgrade to 1.5.1 or later
GitHub advisory

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 1.5.11.5.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-273
Also known as
BIT-superset-2021-37839, CVE-2021-37839, PYSEC-2026-776

More Apache Superset advisories

All Apache Superset
Medium 5.4May 24, 2022Apache Superset Stored XSS on Dashboard markdownCVE-2021-27907fixed in 0.38.1High 8.8May 24, 2022Apache Superset OS Command InjectionCVE-2020-13948fixed in 0.37.1High 6.5May 24, 2022Improper Encoding or Escaping of Output in Apache SupersetCVE-2021-42250fixed in 1.3.2High 6.5May 24, 2022Apache Superset allowed for database connections password leak for authenticated usersCVE-2021-41972fixed in 1.3.2Medium 5.4May 24, 2022Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore pageCVE-2021-32609fixed in 1.2.0High 8.8May 24, 2022Apache Superset SQL Injection when template processing is enabledCVE-2021-41971fixed in 1.3.1