CVE-2023-27523

Published: Sep 6, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

Affected (1)

Products: Apache: Superset

Apache

1 product

Superset

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Superset	Up to 2.1.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h

Source: security@apache.org

Mailing List

https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.