CVE-2023-49734High· 7.7▾ TwilightApache Superset incorrect write permissions vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
0.9% → 0.9%
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
apache-superset < 2.1.3apache-superset >= 3.0.0, < 3.0.2Upgrade to a patched release:
apache-superset 2.1.3apache-superset 3.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23984HighApache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
CVE-2026-23983LowApache Superset allows authenticated users to view sensitive data without explicit permissions
CVE-2026-23980MediumApache Superset allows privileged users to conduct error-based SQL Injection
CVE-2026-23969MediumApache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
CVE-2026-23982HighApache Superset Improper Authorization allows low-privileged users to bypass access controls
CVE-2024-24779Medium· 5.0Apache Superset: Improper data authorization when creating a new dataset