AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-v594-2c97-hx38

Apache Superset vulnerable to improper data authorization

Apache Superset

CVE-2023-27523 · Published Sep 6, 2023 · updated Jul 7, 2026

Medium5.0
No fix yet
GitHub advisory

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 2.1.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
BIT-superset-2023-27523, CVE-2023-27523, PYSEC-2026-1187

More Apache Superset advisories

All Apache Superset
Medium 4.3Sep 6, 2023Apache Superset has incorrect authorization checkCVE-2023-32672no fix yetMedium 6.6Sep 6, 2023Apache Superset Deserialization of Untrusted Data vulnerabilityCVE-2023-37941fixed in 2.1.1Medium 6.5Sep 6, 2023Apache Superset Improper Input Validation vulnerabilityCVE-2023-39265no fix yetMedium 4.3Sep 6, 2023Apache Superset Server Side Request Forgery vulnerabilityCVE-2023-36388no fix yetMedium 5.4Sep 6, 2023Apache Superset has improper default REST API permission for Gamma usersCVE-2023-36387no fix yetMedium 4.3Sep 6, 2023Apache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yet