CVE-2025-27696: Apache Superset: Incorrect authorization leading to resource ownership takeover
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
Other sources
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27696?
CVE-2025-27696 has a moderate severity level due to its potential for authorized users to gain ownership of sensitive dashboards and datasets.
How do I fix CVE-2025-27696?
To fix CVE-2025-27696, upgrade Apache Superset to version 4.1.2 or above.
Who is affected by CVE-2025-27696?
CVE-2025-27696 affects all authenticated users with read permissions in Apache Superset versions up to 4.1.1.
What kind of vulnerability is CVE-2025-27696?
CVE-2025-27696 is categorized as an Improper Authorization vulnerability.
What can be compromised due to CVE-2025-27696?
CVE-2025-27696 can lead to unauthorized takeover of dashboards, charts, and datasets.