Description
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Superset | 2.0.0 – < 2.0.1, ≤ 1.5.2 | 2.0.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-superset | <= 1.5.2 | — | GHSA-7222-r37x-8q3m |
| PyPI | apache-superset | 2.0.0 | — | GHSA-7222-r37x-8q3m |
| PyPI | apache-superset | < 1.5.3 · >= 2.0.0, < 2.0.1 | 1.5.3, 2.0.1 | PYSEC-2026-775 |
References
- https://lists.apache.org/thread/xc309h2dphrkg33154djf3nqlh2xc1c0 vendor-advisory