Improper Authorization in Apache Superset - CVE-2026-23981
Published: August 24, 2026
Vulnerability identifier: #VU144799
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-23981
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify dashboards they do not own.
The vulnerability exists due to improper authorization in the UpdateChartCommand REST API chart update logic when updating a chart's properties with a list of dashboard IDs. A remote user can submit a crafted chart update request to modify dashboards they do not own.
The issue occurs because write permissions for the target dashboards specified in the request body are not verified.
Affected software
Apache Superset
How to mitigate CVE-2026-23981
Install security update from vendor's website.
Apache Superset - update to 6.0.0