AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-vv65-fjfj-4736

Apache Superset has Incorrect Default Permissions

Apache Superset

CVE-2023-42501 · Published Nov 27, 2023 · updated Jul 7, 2026

Medium4.3
Fix: upgrade to 2.1.2 or later
GitHub advisory

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.

This issue affects Apache Superset: before 2.1.2.

Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove can_read permission from the mentioned resources.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 2.1.22.1.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-276
Also known as
BIT-superset-2023-42501, CVE-2023-42501, PYSEC-2026-1188

More Apache Superset advisories

All Apache Superset
Medium 6.5Dec 19, 2023Apache Superset SQL injection vulnerabilityCVE-2023-49736fixed in 2.1.3 +1High 7.3Nov 28, 2023Apache Superset - Elevation of PrivilegeCVE-2023-40610fixed in 2.1.2Medium 5.4Nov 28, 2023Apache Superset Open Redirect vulnerabilityCVE-2023-42502fixed in 3.0.0Medium 4.3Nov 28, 2023Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-42505fixed in 3.0.0Medium 6.5Nov 28, 2023Apache Superset Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2023-42504fixed in 3.0.0Medium 4.3Nov 27, 2023Apache Superset Cross-site Scripting vulnerabilityCVE-2023-43701fixed in 2.1.2