5.3Mittel
CVE-2025-27696Apache Superset: Incorrect authorization leading to resource ownership takeover
Beschreibung
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
Schwachstellentyp (CWE):
CWE-863
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Apache Software Foundation | Apache Superset | ≤ 4.1.1 | |
| apache | superset | < 4.1.2 |
Referenzen und Patches
- https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413 vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2025/05/12/3 Mailing ListThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*< 4.1.2