CVE-2025-48912 — Apache Superset: Improper authorization bypass on row level security via SQL Injection

CVE-2025-48912

Apache Superset: Improper authorization bypass on row level security via SQL Injection PUBLISHED

Description (CNA)

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Superset	affected 0 before 4.1.2

CWE

CWE-89

References

https://lists.apache.org/thread/ms2t2oq218hb7l628trsogo4fj7h1135

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/05/30/3