Advisoriesby Ibis
Apache Superset security advisories
66 advisories · 2 critical or high in 12 months · latest Feb 24
60 of 66 advisories
Apache Superset Improper Authorization allows low-privileged users to bypass access controlsCVE-2026-23982fixed in 6.0.0Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engineCVE-2026-23969fixed in 4.1.2Apache Superset allows privileged users to conduct error-based SQL InjectionCVE-2026-23980fixed in 6.0.0Apache Superset allows authenticated users to view sensitive data without explicit permissionsCVE-2026-23983fixed in 6.0.0Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL ConnectionsCVE-2026-23984fixed in 6.0.0Apache Superset data query improperly discloses database schema information to low-privileged guest userCVE-2025-55673fixed in 4.1.3.post1Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerabilityCVE-2025-55672fixed in 5.0.0Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functionsCVE-2025-55674fixed in 5.0.0Apache Superset: improper access controlCVE-2025-55675fixed in 5.0.0Apache Superset: Improper authorization bypass on row level security via SQL InjectionCVE-2025-48912fixed in 4.1.2Apache Superset Allows Ownership TakeoverCVE-2025-27696fixed in 4.1.2Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633fixed in 4.1.0Apache Superset: Error verbosity exposes metadata in analytics databasesCVE-2024-53948fixed in 4.1.0Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledCVE-2024-53949fixed in 4.1.0Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsCVE-2024-53947fixed in 4.1.0Apache Superset vulnerable to improper SQL authorizationCVE-2024-39887fixed in 4.0.2Apache Superset server arbitrary file readCVE-2024-34693fixed in 3.1.3 +1Apache Superset Incorrect Authorization vulnerabilityCVE-2024-28148fixed in 3.1.2Apache Superset: Improper authorization validation on dashboards and charts importCVE-2024-26016fixed in 3.0.4 +1Apache Superset: Improper data authorization when creating a new datasetCVE-2024-24779fixed in 3.0.4 +1Apache Superset: Improper validation of SQL statements allows for unauthorized access to dataCVE-2024-24773fixed in 3.0.4 +1Apache Superset: Improper Neutralization of custom SQL on embedded contextCVE-2024-24772fixed in 3.0.4 +1Apache Superset: Improper error handling on alertsCVE-2024-27315fixed in 3.0.4 +1Cross-site Scripting in Apache supersetCVE-2023-49657fixed in 3.0.3Apache Superset uncontrolled resource consumptionCVE-2023-46104fixed in 2.1.2 +1Apache Superset incorrect write permissions vulnerabilityCVE-2023-49734fixed in 2.1.3 +1Apache Superset SQL injection vulnerabilityCVE-2023-49736fixed in 2.1.3 +1Apache Superset - Elevation of PrivilegeCVE-2023-40610fixed in 2.1.2Apache Superset Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2023-42504fixed in 3.0.0Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-42505fixed in 3.0.0Apache Superset Open Redirect vulnerabilityCVE-2023-42502fixed in 3.0.0Apache Superset has Incorrect Default PermissionsCVE-2023-42501fixed in 2.1.2Apache Superset Cross-site Scripting vulnerabilityCVE-2023-43701fixed in 2.1.2Apache Superset has incorrect authorization checkCVE-2023-32672no fix yetApache Superset Deserialization of Untrusted Data vulnerabilityCVE-2023-37941fixed in 2.1.1Apache Superset Improper Input Validation vulnerabilityCVE-2023-39265no fix yetApache Superset Server Side Request Forgery vulnerabilityCVE-2023-36388no fix yetApache Superset has improper default REST API permission for Gamma usersCVE-2023-36387no fix yetApache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yetApache Superset may expose internal traces on REST API endpointsCVE-2023-39264no fix yetApache Superset vulnerable to improper data authorizationCVE-2023-27523no fix yetApache Superset vulnerable to Exposure of Sensitive InformationCVE-2023-30776fixed in 2.1.0Apache Superset Server-Side Request Forgery vulnerabilityCVE-2023-25504fixed in 2.1.0Apache superset missing check for default SECRET_KEYCVE-2023-27524fixed in 2.1.0Apache Superset vulnerable to Improper AuthorizationCVE-2023-27525no fix yetApache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpointsCVE-2022-43719no fix yetApache Superset is vulnerable to Cross-Site Scripting (XSS)CVE-2022-43718no fix yetApache Superset vulnerable to Cross-site ScriptingCVE-2022-43717no fix yetApache Superset's SQL Alchemy connector vulnerable to SQL InjectionCVE-2022-41703no fix yetApache Superset has Improper Access ControlCVE-2022-45438no fix yetApache Superset Open Redirect vulnerabilityCVE-2022-43721no fix yetApache Superset vulnerable to InjectionCVE-2022-43720no fix yetApache Superset allows authenticated users to access metadata they have no permission toCVE-2021-37839fixed in 1.5.1Apache Superset Stored XSS on Dashboard markdownCVE-2021-27907fixed in 0.38.1Apache Superset OS Command InjectionCVE-2020-13948fixed in 0.37.1Improper Encoding or Escaping of Output in Apache SupersetCVE-2021-42250fixed in 1.3.2Apache Superset allowed for database connections password leak for authenticated usersCVE-2021-41972fixed in 1.3.2Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore pageCVE-2021-32609fixed in 1.2.0Apache Superset SQL Injection when template processing is enabledCVE-2021-41971fixed in 1.3.1SQL injection in apache-supersetCVE-2022-27479fixed in 1.4.2