Vulnerability · Published May 13, 2025 · Assigned by apache
CVE-2025-27696Apache Superset: Incorrect authorization leading to resource ownership takeover
Medium 5.3
In plain English
A medium-severity incorrect authorization in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | 4.1.2 | GHSA-w6c7-j32f-rq8j |
| PyPI | apache-superset | 4.1.2 | PYSEC-2026-1189 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | 0 – through 4.1.1 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N