CVE-2026-23982: Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset.
This issue affects Apache Superset: before 6.0.0.
Users are recommended to upgrade to version 6.0.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23982?
CVE-2026-23982 is classified as a high severity vulnerability due to its potential for unauthorized access.
How do I fix CVE-2026-23982?
Fixing CVE-2026-23982 involves upgrading Apache Superset to version 6.0.0 or later to ensure proper authorization is enforced.
What systems are affected by CVE-2026-23982?
CVE-2026-23982 affects all versions of Apache Superset prior to 6.0.0.
Who is impacted by CVE-2026-23982?
Low-privileged users in Apache Superset are specifically impacted as they can bypass data access controls.
What type of vulnerability is CVE-2026-23982?
CVE-2026-23982 is an Improper Authorization vulnerability that allows access control bypass during dataset creation.