PT-2024-20551 · Apache · Apache Superset

Daniel Vaz Gaspar

·

CVE-2024-24773

·

Published

2024-02-28

·

Updated

2026-07-07

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0
Description The issue is related to the improper parsing of nested SQL statements on SQLLab, allowing authenticated users to surpass their data authorization scope.
Recommendations For Apache Superset versions prior to 3.0.4, upgrade to version 3.1.1. For Apache Superset versions 3.1.0, upgrade to version 3.1.1.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SUPERSET-2024-24773
CVE-2024-24773
GHSA-5474-F7G5-273Q
PYSEC-2026-1160

Affected Products

Apache Superset