CVE-2026-23981

MediumCVSS 4.3

Published: 30/07/2026(UTC)Updated: 23/10/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

46th percentile - higher than 46% of all known CVEs

Summary

An improper authorization vulnerability in Apache Superset allows an authenticated user with chart update permissions to modify dashboards they do not own. This occurs because the validation in UpdateChartCommand does not check write permissions for target dashboards.

Risk Assessment

The risk is unauthorized modification of dashboards, potentially leading to data integrity issues and disclosure of business information.

Recommendation

Upgrade Apache Superset to version 6.0.0, which includes the fix for this vulnerability.

Other vulnerabilities in Apache Superset

CVE-2026-23985Medium
A ReDoS vulnerability in Apache Superset, located in the sql_parse.py component, allows an authenticated attacker to cause significant server load by sending a crafted SQL query with a long string of characters. This can lead to denial of service.

Original NVD description (English source)

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS