CVE-2025-27696
Apache Superset: Incorrect authorization leading to resource ownership takeover
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Superset: Incorrect authorization leading to resource ownership takeover
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
CVE-2025-27696- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2025-14507
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
EUVD-2025-14507- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w6c7-j32f-rq8j
Apache Superset Allows Ownership Takeover
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
GHSA-w6c7-j32f-rq8j- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285, CWE-863
- Updated
- 2026-11-02
NVD
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
CVE-2025-27696- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Apache Superset: Incorrect authorization leading to resource ownership takeover
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
CVE-2025-27696- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-w6c7-j32f-rq8j
Apache Superset Allows Ownership Takeover
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
GHSA-w6c7-j32f-rq8j- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285, CWE-863
- Updated
- 2026-11-02
OSVPYSEC-2026-1189
Apache Superset Allows Ownership Takeover
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
PYSEC-2026-1189- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-superset-2025-27696 No score
Apache Superset: Incorrect authorization leading to resource ownership takeover
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.
This issue affects Apache Superset: through 4.1.1.
Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
- Record
BIT-superset-2025-27696- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-supersetPyPI |
before 4.1.2 | 4.1.2 |
supersetBitnami |
before 4.1.2 | 4.1.2 |
apache-supersetPyPI |
before 4.1.2, plus listed versions 0.34.00.34.10.35.10.35.20.36.0 Show 45 moreShow less0.37.00.37.10.37.20.38.00.38.11.0.01.0.11.1.01.2.01.3.01.3.11.3.21.4.01.4.11.4.21.5.01.5.11.5.21.5.32.0.02.0.12.1.02.1.12.1.1rc12.1.1rc22.1.1rc32.1.22.1.33.0.03.0.0rc13.0.0rc23.0.0rc33.0.0rc43.0.13.0.23.0.33.0.43.1.03.1.0rc13.1.0rc23.1.0rc33.1.0rc43.1.13.1.23.1.3 |
4.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-27696 is a medium vulnerability (CVSS 5.3) in Apache Superset, published May 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.30%, the 70th percentile. Fixed in apache-superset 4.1.2.
References
lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413
openwall.com/lists/oss-security/2025/05/12/3
nvd.nist.gov/vuln/detail/CVE-2025-27696
github.com/apache/superset/commit/fc844d3dfdace890b32c00a507a959b81122b425
pypi.org/project/apache-superset
Left out here: 12 versions. The JSON record has them.