An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to
    bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users
    from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and
    read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue
    affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the
    issue. (CVE-2026-23982)

ID	Name	Product	Family	Type	Severity
462051	Echo: apache-superset: security update to 6.0.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
462051	Echo: apache-superset: security update to 6.0.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
437990	SCA: security update for apache-superset (GHSA-3m2g-v7jf-7fxc)	Tenable Cloud Security	SCA Checks	Local	high
437990	SCA: security update for apache-superset (GHSA-3m2g-v7jf-7fxc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-23982

high

Tenable Plugins

high

high

high

high