AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-w6c7-j32f-rq8j

Apache Superset Allows Ownership Takeover

Apache Superset

CVE-2025-27696 · Published May 13, 2025 · updated Jul 7, 2026

Medium8.8
Fix: upgrade to 4.1.2 or later
GitHub advisory

Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.

This issue affects Apache Superset: through 4.1.1.

Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 4.1.24.1.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-285, CWE-863
Also known as
BIT-superset-2025-27696, CVE-2025-27696, PYSEC-2026-1189

More Apache Superset advisories

All Apache Superset
MediumAug 14, 2025Apache Superset: improper access controlCVE-2025-55675fixed in 5.0.0MediumAug 14, 2025Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functionsCVE-2025-55674fixed in 5.0.0MediumAug 14, 2025Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerabilityCVE-2025-55672fixed in 5.0.0MediumAug 14, 2025Apache Superset data query improperly discloses database schema information to low-privileged guest userCVE-2025-55673fixed in 4.1.3.post1HighMay 30, 2025Apache Superset: Improper authorization bypass on row level security via SQL InjectionCVE-2025-48912fixed in 4.1.2High 6.5Dec 12, 2024Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633fixed in 4.1.0