CVE-2023-40610High· 7.3▾ TwilightApache Superset - Elevation of Privilege
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
An attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator.
On a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords. Modification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. "V7 - Insecure deserialization leading to remote code execution" report vulnerability).
Some tables are supposed to accept only SELECT requests from the SQL tab.
But this protection can be bypassed by using the WITH … AS () syntax with RETURNING value after the INSERT / UPDATE / DELETE query. INSERT query accepted by the database due to the use of WITH … AS ( … RETURNING ) syntax: WITH a AS ( INSERT INTO ab_user (id, first_name, last_name, username, email, password) VALUES (2, ‘injected_admin’, ‘injected_admin’, ‘injected_admin’, ‘[email protected]’, ‘{PASSWORD_HASH}’) RETURNING id ) SELECT * FROM a; PoC_2
This method can also be used with UPDATE or DELETE request. A user with access to SELECT on the tables ab_user_role can escalate his privilege to become administrator.
This technique can also be used to inject or modify values of the table key_value, which can potentially lead to a Remote Code Execution (cf. ...).
To fix this vulnerability, we recommends reenforcing the SELECT filter to spot INSERT / UPDATE / DELETE keywords even in WITH requests.
Upgrade to Superset version 2.1.2.
https://nvd.nist.gov/vuln/detail/CVE-2023-40610 https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot
LEXFO for Orange Innovation
Orange CERT-CC at Orange group
Date reported: July 27, 2023 Date fixed: November 27, 2023
apache-superset < 2.1.2Upgrade to a patched release:
apache-superset 2.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23984HighApache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
CVE-2026-23983LowApache Superset allows authenticated users to view sensitive data without explicit permissions
CVE-2026-23980MediumApache Superset allows privileged users to conduct error-based SQL Injection
CVE-2026-23969MediumApache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
CVE-2026-23982HighApache Superset Improper Authorization allows low-privileged users to bypass access controls
CVE-2024-24779Medium· 5.0Apache Superset: Improper data authorization when creating a new dataset