VULNERABILITY INTELLIGENCE

CVE-2024-26016

CVSS score4.3 MEDIUM

EPSS probability0.87%

CISA KEVNot currently listed

Published2024-02-28

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.

Weakness classification

security@apache.org: CWE-863

Primary references

security@apache.org — Mailing List, Third Party Advisory
security@apache.org — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory