Executive brief
Apache Superset, a data visualization and exploration platform, contains a security flaw that allows authorized users to modify dashboards they do not own. By exploiting this issue, a user with basic chart-editing permissions could link their charts to any dashboard in the system, potentially disrupting reports or altering the layout of dashboards managed by other teams. This could lead to unauthorized changes in business intelligence displays and operational confusion.
Technical details
An improper authorization vulnerability exists in the `UpdateChartCommand` component of Apache Superset. When an authenticated user updates a chart's properties via the REST API, they can provide a list of dashboard IDs to associate with that chart. The validation logic fails to verify if the requesting user possesses write permissions for the specified target dashboards. Consequently, an attacker with `can_write` permissions on charts can effectively modify the content of dashboards they do not own. This issue is resolved in version 6.0.0.
Affected products
- Apache Superset before 6.0.0
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory
- 2026-07-30: patched: Fixed in version 6.0.0