Apache Superset has improper default REST API permission for Gamma users

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-36387 · ADVISORY
• apache/superset#24185 · WEB
• apache/superset · PACKAGE
• lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3 · WEB
• pypi.org/project/apache-superset · PACKAGE
• GitHub Advisory GHSA-9832-mgg4-3gr6 · ADVISORY

Mais vulnerabilidades de apache-superset

• CVE-2026-23984MÉDIO 6.5An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read…
• CVE-2026-23983MÉDIO 6.5A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The T…
• CVE-2026-23982MÉDIO 6.5An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When cre…
• CVE-2026-23980MÉDIO 6.5Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated…
• CVE-2026-23969MÉDIO 6.5Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functio…