CVE-2025-27696 — Apache Superset: Incorrect authorization leading to resource ownership takeover

CVE-2025-27696

Apache Superset: Incorrect authorization leading to resource ownership takeover PUBLISHED

Description (CNA)

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Superset	affected 0 through 4.1.1

CWE

CWE-863

References

https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/05/12/3

CISA-ADP

No English description supplied.

No references supplied.