Improper Auth: Dataset SQL Overwrite in Apache Superset <6.0
CVE-2026-23982 Published on February 24, 2026

Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Vendor Advisory NVD

Weakness Type

What is an AuthZ Vulnerability?

The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVE-2026-23982 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2026-23982

Want to know whenever a new CVE is published for Apache Superset? stack.watch will email you.

Apache Superset
 

Affected Versions

Apache Software Foundation Apache Superset:

Exploit Probability

EPSS
0.04%
Percentile
11.43%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.