Apache Superset: Improper authorization validation on dashboards and charts import

Vulnerability

Description

Apache Superset's import functionality for dashboards and charts lacks proper authorization checks. A low-privilege authenticated user can import an existing dashboard or chart that they do not have access to, and then modify its metadata to gain ownership of the object [1][3].

Exploitation

The attack requires only a low-privilege account with access to the import feature. The attacker imports an object they cannot normally view, then alters metadata to assume ownership. No additional authentication or network position is needed [1][3].

Impact

Gaining ownership allows the attacker to manage the object, but access to the underlying analytical data remains restricted by existing data access privileges [1]. This represents a partial privilege escalation within the application.

Mitigation

The issue affects Apache Superset versions before 3.0.4 and 3.1.0 before 3.1.1. Users should upgrade to version 3.1.1, which includes the fix [3].