Apache Software Foundation Apache Superset vulnerabilities

CVE-2023-27525 [MEDIUM] CWE-863 CVE-2023-27525: An authenticated user with Gamma role authorization could have access to metadata information using An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

CVE-2025-55673 [MEDIUM] CWE-200 CVE-2025-55673: When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoin When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users

CVE-2023-42505 [MEDIUM] CWE-200 CVE-2023-42505: An authenticated user with read permissions on database connections metadata could potentially acces An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.