Skip to main content

Improper Authorization

CVE-2025-55675

Medium
5.3/10

Summary

Apache Superset contains an improper access control vulnerability in its `/explore` endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the `datasource_id` in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects apache-superset versions 2.1.0rc3 through 4.1.4 and 5.0.0rc1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-285 - Improper Authorization

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References

Advisory Timeline

  • Published