CVE-2026-23982

UNKNOWN 0.0

Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

CWE	CWE-863
Vendor	apache software foundation
Product	apache superset
Published	Feb 24, 2026
Last Updated	Feb 24, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache superset

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache superset are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Superset

0.0.0 < 6.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fp openwall.com: http://www.openwall.com/lists/oss-security/2026/02/24/6

Credits

🔍 River Koh Daniel Gaspar