AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-7jhg-8m74-6f6g

Apache Superset vulnerable to Improper Authorization

Apache Superset

CVE-2023-27525 · Published Apr 17, 2023 · updated Jul 7, 2026

Medium4.3
No fix yet
GitHub advisory

An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 2.0.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
BIT-superset-2023-27525, CVE-2023-27525, PYSEC-2026-1163

More Apache Superset advisories

All Apache Superset
Medium 6.5Jul 6, 2023Apache Superset vulnerable to Exposure of Sensitive InformationCVE-2023-30776fixed in 2.1.0Medium 6.5Jul 6, 2023Apache Superset Server-Side Request Forgery vulnerabilityCVE-2023-25504fixed in 2.1.0High 8.9Apr 24, 2023Apache superset missing check for default SECRET_KEYCVE-2023-27524fixed in 2.1.0High 8.8Jan 16, 2023Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpointsCVE-2022-43719no fix yetMedium 5.4Jan 16, 2023Apache Superset is vulnerable to Cross-Site Scripting (XSS)CVE-2022-43718no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to Cross-site ScriptingCVE-2022-43717no fix yet