CVE-2025-27696

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

Score

CVSS 3.1 8.8 High

Status

Analyzed - security@apache.org

Published

2025-05-13

Last modified

2025-09-01

Weaknesses

CWE-863

Affected products

• Superset (Apache)
• Apache Superset (Apache Software Foundation)

References

• https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413
• http://www.openwall.com/lists/oss-security/2025/05/12/3