{"id":"CVE-2024-55633","aliases":["GHSA-787v-v9vq-4rgv","BIT-superset-2024-55633","PYSEC-2026-1162"],"title":"Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access","summary":"Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","vendor":"apache-superset","product":"apache-superset","ecosystem":"pip","affected":["apache-superset < 4.1.0"],"patched":["apache-superset 4.1.0"],"published":"2024-12-12","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-787v-v9vq-4rgv","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55633"},{"url":"https://github.com/apache/superset"},{"url":"https://lists.apache.org/thread/bwmd17fcvljt9q4cgctp4v09zh3qs7fb"},{"url":"http://www.openwall.com/lists/oss-security/2024/12/12/1"}],"tags":["osv","pip"],"epss":0.02806,"epssPercentile":0.85902,"ingestedAt":"2026-07-08T18:25:46.806Z","slug":"CVE-2024-55633","body":"## Overview\n\nImproper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. \n\nThis issue affects Apache Superset: before 4.1.0.\n\nUsers are recommended to upgrade to version 4.1.0, which fixes the issue.\n\n## Affected packages\n\n- `apache-superset < 4.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-superset 4.1.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.6,"exploitation":0,"ransomware":0},"changes":[]}