CVE-2024-26016
published 2024-02-28CVE-2024-26016: A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.87%
54.5th percentile
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | < 3.0.4 | 3.0.4 |
| apache | superset | >= 3.1.0 < 3.1.1 | 3.1.1 |
| apache_software_foundation | apache_superset | < 3.0.4 | 3.0.4 |
| apache_software_foundation | apache_superset | >= 3.1.0 < 3.1.1 | 3.1.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Superset: Improper authorization validation on dashboards and charts import
osv·2024-02-28
CVE-2024-26016 [MEDIUM] Apache Superset: Improper authorization validation on dashboards and charts import
Apache Superset: Improper authorization validation on dashboards and charts import
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.
GHSA
Apache Superset: Improper authorization validation on dashboards and charts import
ghsa·2024-02-28
CVE-2024-26016 [MEDIUM] CWE-863 Apache Superset: Improper authorization validation on dashboards and charts import
Apache Superset: Improper authorization validation on dashboards and charts import
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-28
Published