5.3Media
CVE-2025-27696Apache Superset: Incorrect authorization leading to resource ownership takeover
Descripción
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
Debilidad (CWE):
CWE-863
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Apache Software Foundation | Apache Superset | ≤ 4.1.1 | |
| apache | superset | < 4.1.2 |
Referencias y parches
- https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413 vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2025/05/12/3 Mailing ListThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*< 4.1.2