Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass

Root

Cause

An improper authorization vulnerability (CVE-2026-23982) exists in Apache Superset. The bug lies in the dataset creation workflow: while permission checks are enforced when creating a new dataset from scratch, they are not properly revalidated when an existing dataset's SQL query is overwritten [1][3]. This oversight allows an attacker to replace the query with one that accesses unauthorized data sources or tables.

Exploitation

Prerequisites

To exploit this flaw, an attacker must be authenticated to the Superset instance and possess the "write datasets" and "read charts" permissions. No administrative privileges are required [1][3]. The attacker can then edit the SQL query of an existing dataset they have access to, effectively repurposing that dataset to query arbitrary tables or databases that the Superset backend can reach.

Impact

A successful attack bypasses the intended data access controls, enabling a low-privileged user to read sensitive information from any database that Superset is configured to connect to [1][3]. The attacker gains the ability to extract confidential data stored in otherwise restricted tables, potentially leading to a severe data breach.

Mitigation

The vulnerability affects all Apache Superset versions prior to 6.0.0. The fix is included in version 6.0.0 [1][3]. Users are strongly advised to upgrade to 6.0.0 or later. No workarounds have been published.