AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-9832-mgg4-3gr6

Apache Superset has improper default REST API permission for Gamma users

Apache Superset

CVE-2023-36387 · Published Sep 6, 2023 · updated Jul 7, 2026

Medium5.4
No fix yet
GitHub advisory

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 2.1.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-281, CWE-863, CWE-918
Also known as
BIT-superset-2023-36387, CVE-2023-36387, PYSEC-2026-1168

More Apache Superset advisories

All Apache Superset
Medium 4.3Sep 6, 2023Apache Superset has incorrect authorization checkCVE-2023-32672no fix yetMedium 6.6Sep 6, 2023Apache Superset Deserialization of Untrusted Data vulnerabilityCVE-2023-37941fixed in 2.1.1Medium 6.5Sep 6, 2023Apache Superset Improper Input Validation vulnerabilityCVE-2023-39265no fix yetMedium 4.3Sep 6, 2023Apache Superset Server Side Request Forgery vulnerabilityCVE-2023-36388no fix yetMedium 4.3Sep 6, 2023Apache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yetMedium 4.3Sep 6, 2023Apache Superset may expose internal traces on REST API endpointsCVE-2023-39264no fix yet