{"id":"CVE-2023-27523","aliases":["BIT-superset-2023-27523","EUVD-2023-2595","GHSA-v594-2c97-hx38","PYSEC-2026-1187"],"status":"published","title":"Apache Superset: Improper data permission validation on Jinja templated queries","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01019,"percentile":0.63826,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2023-09-06T12:55:31Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Bitnami","package":"superset","fixed_in":["2.1.1"],"sources":["osv"]},{"ecosystem":"PyPI","package":"apache-superset","fixed_in":["2.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"superset","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.0"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","2.0.0","2.0.1","2.1.0"]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","2.0.0","2.0.1","2.1.0","2.1.1rc1","2.1.1rc2","2.1.1rc3"]}],"products":[{"vendor":"apache","product":"superset"},{"vendor":"apache software foundation","product":"apache superset"}],"references":[{"url":"https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h","tags":["vendor-advisory","x_transferred","Mailing List","discussion","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27523","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v594-2c97-hx38","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27523.json","tags":["advisory"]},{"url":"https://github.com/apache/superset","tags":["package"]},{"url":"https://pypi.org/project/apache-superset","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-27523","title":"Apache Superset: Improper data permission validation on Jinja templated queries","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.\n\n","status":"published","published":"2023-09-06T12:55:31.286Z","modified":"2024-09-26T15:24:13.311Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-2595","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.\n\n","status":"published","published":"2023-09-06T12:55:31Z","modified":"2024-09-26T15:24:13Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:09.023721Z"}],"ghsa":[{"id":"GHSA-v594-2c97-hx38","title":"Apache Superset vulnerable to improper data authorization","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.\n\n","status":"published","published":"2023-09-06T15:30:26Z","modified":"2023-11-06T05:05:10Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2023-27523","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.\n\n","status":"published","published":"2023-09-06T13:15:08.017Z","modified":"2026-06-17T05:45:23.78Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"CVE-2023-27523","title":"Apache Superset: Improper data permission validation on Jinja templated queries","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.\n\n","status":"published","published":"2023-09-06T12:55:31.286Z","modified":"2026-10-28T02:30:36.930891001Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-v594-2c97-hx38","title":"Apache Superset vulnerable to improper data authorization","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.\n\n","status":"published","published":"2023-09-06T15:30:26Z","modified":"2026-07-07T17:57:11.702828025Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"PYSEC-2026-1187","title":"Apache Superset vulnerable to improper data authorization","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.\n\n","status":"published","published":"2026-07-07T11:45:23.401916Z","modified":"2026-07-07T17:57:11.702828025Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"BIT-superset-2023-27523","title":"Apache Superset: Improper data permission validation on Jinja templated queries","description":"Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.","status":"published","published":"2025-02-05T07:28:36.91Z","modified":"2026-09-08T08:48:16.729206812Z","updated_at":"2026-11-02T15:28:35.51001Z"}]}}