CVE-2026-23981

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description An improper authorization issue allows an authenticated user with chart update permissions to modify dashboards they do not own. This occurs when updating chart properties via the REST API, where a user can provide a list of dashboard IDs through the dashboards variable to associate the chart with. The validation logic in the UpdateChartCommand() function fails to verify if the user possesses write permissions for the specified target dashboards.

Recommendations Upgrade to version 6.0.0.