CVE-2026-23982 Details
Description
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
A vulnerability allowing improper authorization has been identified in Apache Superset versions prior to 6.0.0. This vulnerability enables low-privileged users to bypass data access controls. When a dataset is created, Superset typically enforces permission checks to prevent unauthorized data queries. However, an authenticated user with the ability to write datasets and read charts can exploit this vulnerability by overwriting the SQL query of an existing dataset, thereby bypassing the access controls.
Users are advised to upgrade to Apache Superset version 6.0.0 or later, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/02/24/6 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fp | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache superset | < 6.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | CVE Modified | CVE |
| Feb 24, 2026 | New CVE Received | [email protected] |