Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-27526 BIT-superset-2023-27526EUVD-2023-2483GHSA-9qc3-p9jq-2x27PYSEC-2026-1170

Apache Superset: Improper Authorization check on import charts

Published Sep 6, 2023 · Updated Sep 26, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Superset Package: apache-superset Ecosystem: PyPI

Description

A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. 

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Superset ≤ 2.1.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-superset <= 2.1.0 — GHSA-9qc3-p9jq-2x27
PyPI apache-superset < 2.1.1 2.1.1 PYSEC-2026-1170

References