PT-2024-20556 · Apache · Apache Superset

Dlt1412

·

CVE-2024-24779

·

Published

2024-02-28

·

Updated

2026-07-07

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0
Description The issue allows users with custom roles that include can write on dataset and without all data access permissions to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.
Recommendations For Apache Superset versions prior to 3.0.4, upgrade to version 3.0.4. For Apache Superset versions 3.1.0, upgrade to version 3.1.1.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SUPERSET-2024-24779
CVE-2024-24779
GHSA-WR6G-9WCR-CMQJ
PYSEC-2026-1191

Affected Products

Apache Superset