PYSEC-2026-1180

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/apache-superset/PYSEC-2026-1180.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1180
Aliases
Published
2026-07-07T11:45:29.133260Z
Modified
2026-07-07T17:56:25.402720653Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
Apache Superset incorrect write permissions vulnerability
Details

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2.

Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.

References

Affected packages

PyPI / apache-superset

Package

Name
apache-superset
View open source insights on deps.dev
Purl
pkg:pypi/apache-superset

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.3
Introduced
3.0.0
Fixed
3.0.2

Affected versions

0.*
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.*
2.0.0
2.0.1
2.1.0
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.1
2.1.2
3.*
3.0.0
3.0.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/apache-superset/PYSEC-2026-1180.yaml"