AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-95ch-p3gw-23qg

Apache Superset has incorrect authorization check

Apache Superset

CVE-2023-32672 · Published Sep 6, 2023 · updated Jul 7, 2026

Medium4.3
No fix yet
GitHub advisory

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 2.1.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
BIT-superset-2023-32672, CVE-2023-32672, PYSEC-2026-1166

More Apache Superset advisories

All Apache Superset
Medium 6.6Sep 6, 2023Apache Superset Deserialization of Untrusted Data vulnerabilityCVE-2023-37941fixed in 2.1.1Medium 6.5Sep 6, 2023Apache Superset Improper Input Validation vulnerabilityCVE-2023-39265no fix yetMedium 4.3Sep 6, 2023Apache Superset Server Side Request Forgery vulnerabilityCVE-2023-36388no fix yetMedium 5.4Sep 6, 2023Apache Superset has improper default REST API permission for Gamma usersCVE-2023-36387no fix yetMedium 4.3Sep 6, 2023Apache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yetMedium 4.3Sep 6, 2023Apache Superset may expose internal traces on REST API endpointsCVE-2023-39264no fix yet