CVE-2023-42501: Apache Superset Incorrect Default Permissions
Summary
CVE-2023-42501: Apache Superset has Incorrect Default Permissions. Affects apache-superset versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2023-42501 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and perform data analysis. It is written in Python and provides a web-based interface for data exploration. Apache Superset is widely used in various industries for business intelligence and data analytics purposes. However, a vulnerability has been discovered in versions before 2.1.2 that allows authenticated users to gain unnecessary read permissions within the Gamma role, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability in Apache Superset before version 2.1.2 arises from incorrect default permissions within the Gamma role. Authenticated users with read permissions can access configured CSS templates and annotations, which may contain sensitive information. This could lead to unauthorized access to data and potential data leaks. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.2
This is the first release that contains the fix.
pip install --upgrade "apache-superset==2.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
Apache Superset users should upgrade to version 2.1.2 or above and take necessary steps to address the vulnerability. It is important to ensure that the Gamma role is properly reconstructed or the 'can_read' permission is removed from the affected resources. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform used for creating interactive dashboards and performing data analysis.
The vulnerability allows authenticated users to gain unnecessary read permissions within the Gamma role, potentially exposing sensitive information and leading to unauthorized access to data.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
To fix this vulnerability, users should upgrade to Apache Superset version 2.1.2 or above and run 'superset init' to reconstruct the Gamma role. Alternatively, users can remove the 'can_read' permission from the affected resources.
There is no specific workaround mentioned for this vulnerability. However, following the steps mentioned in the 'how_to_fix' section can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
