Executive brief
Apache Superset has improper default REST API permission for Gamma users
Affected products
- PyPI apache-superset
Junglewise Threat Intelligence
CVE-2023-36387: PYSEC-2026-1168 - Apache Superset has improper default REST API permission for Gamma users
CVE-2023-36387 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: apache-superset (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1178 - Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
- PYSEC-2026-1169 - Apache Superset data query improperly discloses database schema information to low-privileged guest user
- PYSEC-2026-1176 - Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
- PYSEC-2026-1186 - Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
- PYSEC-2026-1164 - Apache Superset: Improper authorization bypass on row level security via SQL Injection