Which versions of Apache Superset are affected by CVE-2026-23981?

Apache Superset versions prior to 6.0.0 contain an improper authorization vulnerability in the chart update API that allows authenticated users with chart-update permissions to modify dashboards they…. A patch is available.

How to fix or mitigate CVE-2026-23981?

Within 24 hours: inventory all Apache Superset deployments and document current versions, identify all users with chart-update permissions, and audit recent dashboard modifications for unauthorized changes. Within 7 days: restrict chart-update permissions to a minimal set of trusted administrators, implement detailed logging and alerts for all dashboard and chart modifications, and review access controls on sensitive dashboards. Within 30 days: upgrade Apache Superset to version 6.0.0 or later when the vendor releases the patch, and conduct a comprehensive audit of all dashboard associations to detect any prior unauthorized modifications.

Apache Superset CVE-2026-23981

Q: What is the CVSS score of CVE-2026-23981?

CVE-2026-23981 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51186 MEDIUM

Improper Authorization (CWE-285)

2026-07-30

GHSA-m2w6-cg52-6hhj

Authentication Bypass Apache Superset

5.3

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible REST API (AV:N), low complexity; requires authenticated chart-editor account (PR:L); impacts only dashboard integrity (I:L), no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 17:03 EUVD

CVSS changed

Jul 30, 2026 - 16:37 NVD

5.3 (MEDIUM)

Analysis Generated

Jul 30, 2026 - 12:16 vuln.today

CVE Published

Jul 30, 2026 - 11:16 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Improper authorization in Apache Superset's chart update REST API allows any authenticated user holding chart-update permissions to associate charts with dashboards they do not own, effectively modifying those dashboards without authorization. All Superset versions from 0.0.0 up to (but not including) 6.0.0 are affected. The root cause is that UpdateChartCommand accepted arbitrary dashboard IDs from the request body without verifying the caller held write permissions on those target dashboards. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache Superset is an open-source data visualization and business intelligence platform that exposes a Flask-AppBuilder REST API for managing charts, dashboards, and datasets. The vulnerability lies in the server-side UpdateChartCommand handler, which processes PUT requests to the /api/v1/chart/<id> endpoint. When a client submits a dashboards list in the request body, the command performs ownership validation only on the chart being updated, not on the dashboard objects referenced as association targets. This is a missing object-level authorization check - a pattern classified under CWE-862 (Missing Authorization) - where the API trusts user-supplied foreign keys without enforcing access control on the referenced resources. No CWE was formally assigned in the advisory, but the described logic gap maps directly to broken object-level authorization (BOLA/IDOR) on the dashboard resource.

RemediationAI

Upgrade to Apache Superset 6.0.0 or later, which resolves the missing authorization check in UpdateChartCommand. The fix was developed by Daniel Gaspar per the advisory credit. The vendor advisory and project homepage are available at https://superset.apache.org and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-23981. If immediate upgrade is not feasible, compensating controls include restricting chart-update permissions to a minimal set of trusted users via Superset's role-based access control, auditing the chart-dashboard association tables for unexpected mappings, and enabling detailed API access logging to detect unauthorized dashboard ID references in chart update payloads. Restricting RBAC permissions reduces attack surface but does not eliminate the underlying flaw; it is not a substitute for patching.