Apache Superset Incorrect Authorization vulnerability

MEDIUM 4.3CVE-2024-28148 · BIT-superset-2024-28148 · GHSA-299q-3p96-5898 · Published 07/05/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
apache-superset PyPI	`< 3.1.2`	`3.1.2`
superset apache	`< 4.0.0`	`4.0.0`

Description

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2.

Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

NVD description

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-28148 · ADVISORY
apache/superset · PACKAGE
lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo · WEB
pypi.org/project/apache-superset · PACKAGE
GitHub Advisory GHSA-299q-3p96-5898 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free