CVE-2026-23981: Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification
An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body.
This issue affects Apache Superset: before 6.0.0.
Users are recommended to upgrade to version 6.0.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Supersetto a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23981?
The severity of CVE-2026-23981 is rated at 40, indicating a significant risk of unauthorized modifications.
How do I fix CVE-2026-23981?
To fix CVE-2026-23981, ensure proper authorization checks are implemented for chart updates to restrict dashboard modifications to their owners.
What version of Apache Superset is affected by CVE-2026-23981?
CVE-2026-23981 affects versions of Apache Superset that allow authenticated users to modify dashboards through chart updates.
What impact does CVE-2026-23981 have on Apache Superset users?
The impact of CVE-2026-23981 allows unauthorized users to modify dashboards, potentially leading to data integrity issues.
Is there a workaround for CVE-2026-23981?
A potential workaround for CVE-2026-23981 is to restrict chart update permissions until an official patch is implemented.