Apache Superset: Incorrect datasource authorization on REST API

Vulnerability

Description

CVE-2025-55675 describes an improper access control vulnerability in Apache Superset's /explore endpoint. The root cause is a missing authorization check that fails to verify a user's permissions on a datasource when accessing its metadata through this REST API endpoint. This flaw affects all Superset versions prior to 5.0.0 [1][3].

Exploitation

Method

An authenticated attacker can exploit this by manually iterating through the datasource_id parameter in the URL of the /explore endpoint. No special privileges or elevated permissions are required beyond possessing a valid user account on the Superset instance. The attacker does not need any prior knowledge of protected datasources; simple brute-force iteration of numeric IDs suffices [1][3].

Impact

Successful exploitation allows the attacker to confirm the existence of datasources they should not have access to and retrieve their names. This constitutes sensitive information disclosure, as the exposure of datasource names can reveal business-sensitive or confidential data schemas. The vulnerability does not grant the attacker direct access to the underlying data in the datasource, but the leaked metadata can inform further targeted attacks [1].

Mitigation

Apache Software Foundation has fixed this issue in Apache Superset version 5.0.0. Users are strongly recommended to upgrade to this release or later. No workarounds have been publicly documented, making the upgrade the sole mitigation path [1][3].