CVE-2025-48912

CWE-89 — SQL Injection4 documents4 sources
Severity
7.1HIGH
EPSS
0.5%
top 36.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache SupersetApache Superset
Timeline
PublishedMay 30

Description

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDapache/superset< 4.1.2
▶PyPIapache-superset< 4.1.2

🔴Vulnerability Details

3
OSV
Apache Superset: Improper authorization bypass on row level security via SQL Injection↗2025-05-30
▶
CVEList
Apache Superset: Improper authorization bypass on row level security via SQL Injection↗2025-05-30
▶
GHSA
Apache Superset: Improper authorization bypass on row level security via SQL Injection↗2025-05-30
▶
CVE-2025-48912 (HIGH CVSS 7.1) | An authenticated malicious actor us | cvebase.io