Auth bypass in Apache Software Foundation Superset
CVE-2026-23981
An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provid…
Affected products
- Apache Software Foundation Superset — versions 0.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108