Apache Superset Improper Authorization Vulnerability in Dataset Creation Allows Access Control Bypass

A vulnerability allowing improper authorization has been identified in Apache Superset versions prior to 6.0.0. This vulnerability enables low-privileged users to bypass data access controls. When a dataset is created, Superset typically enforces permission checks to prevent unauthorized data queries. However, an authenticated user with the ability to write datasets and read charts can exploit this vulnerability by overwriting the SQL query of an existing dataset, thereby bypassing the access controls.

Impact

Exploitation of this vulnerability allows low-privileged users to bypass data access controls, potentially leading to unauthorized data access.

Remediation

Users are advised to upgrade to Apache Superset version 6.0.0 or later, which addresses this vulnerability.