Improper Authorization in Apache Superset Affects Dashboard Ownership
CVE-2025-27696

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Superset
Vendor
CVE Published:
13 May 2025

What is CVE-2025-27696?

An improper authorization vulnerability in Apache Superset can lead to unauthorized ownership takeover of dashboards, charts, or datasets. Authenticated users with read permissions may exploit this weakness to gain control over sensitive resources. It is crucial for users to upgrade to version 4.1.2 or later to mitigate this security risk.

Affected Version(s)

Apache Superset 0 <= 4.1.1

References

https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcx...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JoĂŁo Marono
Daniel Gaspar
.
CVE-2025-27696 : Improper Authorization in Apache Superset Affects Dashboard Ownership