AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-8f5j-mgx9-5hm5

Apache Superset has Improper Access Control

Apache Superset

CVE-2022-45438 · Published Jan 16, 2023 · updated Jul 7, 2026

Medium5.3
No fix yet
GitHub advisory

When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 1.5.2No fix yet
<= 2.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-284, CWE-668
Also known as
BIT-superset-2022-45438, CVE-2022-45438, PYSEC-2026-778

More Apache Superset advisories

All Apache Superset
High 8.8Jan 16, 2023Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpointsCVE-2022-43719no fix yetMedium 5.4Jan 16, 2023Apache Superset is vulnerable to Cross-Site Scripting (XSS)CVE-2022-43718no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to Cross-site ScriptingCVE-2022-43717no fix yetMedium 5.4Jan 16, 2023Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionCVE-2022-41703no fix yetMedium 5.4Jan 16, 2023Apache Superset Open Redirect vulnerabilityCVE-2022-43721no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to InjectionCVE-2022-43720no fix yet