CVE-2026-23981

Katalog CVE

CVSS 4.3 · Medium EPSS 0,56%

Kerentanan Improper Authorization pada apache superset. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/k7q9z27t901xvqnkwgyns1l7w1dj3csf mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/07/30/6 mailing list · advisory pihak ketiga