Apache Superset has improper default REST API permission for Gamma users

Medium5.4CVE-2023-36387 · Published Sep 6, 2023 · updated Jul 7, 2026

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

GitHub advisory

Affected versions

Package	Affected	Fixed in
apache-superset PyPI	<= 2.1.0	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Severity from: GitHub (reviewed advisory)
Weakness: CWE-281, CWE-863, CWE-918
Also known as: BIT-superset-2023-36387, CVE-2023-36387, PYSEC-2026-1168

More Apache Superset advisories

All Apache Superset

Date	Advisory	Severity	Fixed in
Sep 62023	Apache Superset has incorrect authorization check Medium4.3Sep 6, 2023 CVE-2023-32672No fix yet	Medium4.3	No fix yet
Sep 62023	Apache Superset Deserialization of Untrusted Data vulnerability Medium6.6Sep 6, 2023 CVE-2023-379412.1.1	Medium6.6	2.1.1
Sep 62023	Apache Superset Improper Input Validation vulnerability Medium6.5Sep 6, 2023 CVE-2023-39265No fix yet	Medium6.5	No fix yet
Sep 62023	Apache Superset Server Side Request Forgery vulnerability Medium4.3Sep 6, 2023 CVE-2023-36388No fix yet	Medium4.3	No fix yet
Sep 62023	Apache Superset users may incorrectly create resources using the import charts feature Medium4.3Sep 6, 2023 CVE-2023-27526No fix yet	Medium4.3	No fix yet
Sep 62023	Apache Superset may expose internal traces on REST API endpoints Medium4.3Sep 6, 2023 CVE-2023-39264No fix yet	Medium4.3	No fix yet

Affected versions

More Apache Superset advisories

Critical advisories by email