Medium severity6.5NVD Advisory· Published Feb 24, 2026· Updated Jun 17, 2026
CVE-2026-23982
CVE-2026-23982
Description
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset.
This issue affects Apache Superset: before 6.0.0.
Users are recommended to upgrade to version 6.0.0, which fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
apache-supersetPyPI | < 6.0.0 | 6.0.0 |
Affected products
4- osv-coords2 versions
< 6.0.0+ 1 more
- (no CPE)range: < 6.0.0
- (no CPE)range: < 6.0.0
Patches
Vulnerability mechanics
References
4- www.openwall.com/lists/oss-security/2026/02/24/6nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-3m2g-v7jf-7fxcghsaADVISORY
- lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fpnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-23982ghsaADVISORY
News mentions
0No linked articles in our index yet.