GHSA-35fc-9hrj-3585HighCVSS 6.5

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Published
December 9, 2024
Last Modified
February 11, 2025

🔗 CVE IDs covered (1)

CVE-2024-53949 →

📋 Description

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.

 issue affects Apache Superset: from 2.0.0 before 4.1.0.

Users are recommended to upgrade to version 4.1.0, which fixes the issue.

🎯 Affected products1

  • pip/apache-superset:>= 2.0.0, < 4.1.0

🔗 References (5)