BIT-superset-2025-55675

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2025-55675.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-superset-2025-55675
Aliases
Published
2025-08-18T08:13:52Z
Modified
2026-07-07T17:57:04Z
Summary
Apache Superset: Incorrect datasource authorization on REST API
Details

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:apache:superset:*:*:*:*:*:python:*:*"
    ],
    "severity":  "Medium"
}
References

Affected packages

Bitnami / superset

Package

Name
superset
Purl
pkg:bitnami/superset

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.0.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2025-55675.json"