Apache Superset Improper Access Control Vulnerability in Explore Endpoint Allowing Metadata Enumeration

An improper access control vulnerability has been identified in Apache Superset versions prior to 5.0.0, specifically within the /explore endpoint. The vulnerability arises from a missing authorization check, which enables authenticated users to access metadata about datasources they are not authorized to view. By manipulating the datasource_id in the URL, an attacker can enumerate and verify the existence and names of protected datasources, resulting in unauthorized disclosure of sensitive information.

Impact

Exploitation of this vulnerability allows for unauthorized enumeration of protected datasources, potentially leading to disclosure of sensitive metadata.

Remediation

Users are advised to upgrade to Apache Superset version 5.0.0 or later, which addresses this vulnerability.