Improper Access Control in Apache Superset Allows Unauthorized Metadata Exposure

CVE-2025-55675

What is CVE-2025-55675?

An improper access control vulnerability exists in Apache Superset's /explore endpoint, permitting authenticated users to access metadata from datasources they are not authorized to view. This flaw arises due to a lack of necessary authorization checks, enabling attackers to manipulate the datasource_id in the URL to enumerate and confirm protected datasources. Ultimately, this oversight can lead to inadvertent exposure of sensitive information, making it crucial for users to upgrade to version 5.0.0 or later to mitigate the risk.

References