CVE-2025-27696

HIGH

Apache Superset <= 4.1.1 - Authenticated Ownership Takeover via Dashboard Chart or Dataset

Title source: llm

Description

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

References (2)

Core 2

Core References

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2025/05/12/3

Mailing List, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413

Scores

CVSS v3 8.8

EPSS 0.0008

EPSS Percentile 23.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (2)

apache/superset < 4.1.2

pypi/apache-superset 0 - 4.1.2PyPI

Published May 13, 2025

Tracked Since Feb 18, 2026