Improper Authorization in Apache Superset Affects Dashboard Ownership
CVE-2025-27696

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Superset
Vendor
CVE Published:
13 May 2025

What is CVE-2025-27696?

An improper authorization vulnerability in Apache Superset can lead to unauthorized ownership takeover of dashboards, charts, or datasets. Authenticated users with read permissions may exploit this weakness to gain control over sensitive resources. It is crucial for users to upgrade to version 4.1.2 or later to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Superset 0 <= 4.1.1

References

https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcx...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Marono
Daniel Gaspar
JSON
.