Advisoriesby IbisApache SupersetGHSA-9g5x-mm39-wg9r
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Fix: upgrade to 4.1.3.post1 or later
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.
This issue affects Apache Superset: before 4.1.3.
Users are recommended to upgrade to version 4.1.3, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | < 4.1.3.post1 | 4.1.3.post1 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-superset-2025-55673, CVE-2025-55673, PYSEC-2026-1169
More Apache Superset advisories
All Apache Superset
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL ConnectionsCVE-2026-23984fixed in 6.0.0Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerabilityCVE-2025-55672fixed in 5.0.0Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functionsCVE-2025-55674fixed in 5.0.0Apache Superset: improper access controlCVE-2025-55675fixed in 5.0.0Apache Superset: Improper authorization bypass on row level security via SQL InjectionCVE-2025-48912fixed in 4.1.2Apache Superset Allows Ownership TakeoverCVE-2025-27696fixed in 4.1.2