CVE-2023-49734 json
Apache Superset: Privilege Escalation Vulnerability
published 2023-12-19 2 y ago modified 2026-09-10 59 d ago also BIT-superset-2023-49734 , EUVD-2023-3204 , GHSA-g49j-j489-3xpf , PYSEC-2026-1180
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
Patch / fix
- pypi apache-superset 2.1.3, 3.0.2
- bitnami superset 2.1.2, 3.0.2
- Apache Software Foundation Apache Superset 2.1.2, 3.0.2
- github.com/apache/superset@5198279 commit
- github.com/apache/superset@cb6de0a commit
- github.com/apache/superset#25843 pull request
Exploit prediction
0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-superset | <2.1.3 >=3.0.0, <3.0.2 |
2.1.3 3.0.2 |
| bitnami | superset | <2.1.2 >=3.0.0, <3.0.2 |
2.1.2 3.0.2 |
Affected products
- Apache Software Foundation Apache Superset
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/apache/superset/pull/25843
web
-
github.com
/apache/superset/commit/5198279a2ba41ab3e89bd9d7750694179d3f9fe6
web
-
github.com
/apache/superset/commit/cb6de0a9c9f505ee3f26e79ca9bfa5f3901528a0
web
-
lists.apache.org
/thread/985h6ltvtbvdoysso780kkj7x744cds5
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2023/12/19/3
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-49734
advisory, web
-
github.com
/apache/superset
package
-
pypi.org
/project/apache-superset
package
-
github.com
/advisories/GHSA-g49j-j489-3xpf
advisory
Sources
- CVE List CVE-2023-49734
- GitHub Advisory GHSA-g49j-j489-3xpf
- NVD CVE-2023-49734
- OSV BIT-superset-2023-49734
- OSV PYSEC-2026-1180
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.