Apache Superset Allows Ownership Takeover

HIGH 8.8CVE-2025-27696 · BIT-superset-2025-27696 · GHSA-w6c7-j32f-rq8j · Published 13/05/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
apache-superset PyPI	`< 4.1.2`	`4.1.2`
superset apache	`< 4.1.2`	`4.1.2`

Description

Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.

This issue affects Apache Superset: through 4.1.1.

Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

NVD description

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2025-27696 · ADVISORY
apache/superset commit fc844d3 · WEB
apache/superset · PACKAGE
lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413 · WEB
openwall.com/lists/oss-security/2025/05/12/3 · WEB
pypi.org/project/apache-superset · PACKAGE
GitHub Advisory GHSA-w6c7-j32f-rq8j · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free