Advisoriesby IbisApache SupersetGHSA-8w7f-8pr9-xgwj
Apache Superset: Improper authorization bypass on row level security via SQL Injection
Fix: upgrade to 4.1.2 or later
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.
This issue affects Apache Superset: before 4.1.2.
Users are recommended to upgrade to version 4.1.2, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | < 4.1.2 | 4.1.2 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- BIT-superset-2025-48912, CVE-2025-48912, PYSEC-2026-1164
More Apache Superset advisories
All Apache Superset
Apache Superset: improper access controlCVE-2025-55675fixed in 5.0.0Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functionsCVE-2025-55674fixed in 5.0.0Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerabilityCVE-2025-55672fixed in 5.0.0Apache Superset data query improperly discloses database schema information to low-privileged guest userCVE-2025-55673fixed in 4.1.3.post1Apache Superset Allows Ownership TakeoverCVE-2025-27696fixed in 4.1.2Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633fixed in 4.1.0