oss-security - CVE-2025-55675: Apache Superset: Incorrect datasource authorization on REST API

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6b5689af-8eab-2b6f-de75-25f8529f60e7@apache.org>
Date: Thu, 14 Aug 2025 11:43:28 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-55675: Apache Superset: Incorrect datasource
 authorization on REST API 

Severity: 

Affected versions:

- Apache Superset before 5.0.0

Description:

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

Credit:

Daniel Höxtermann / hxtmdev (remediation developer)
Pedro Sousa (coordinator)

References:

https://www.cve.org/CVERecord?id=CVE-2025-55675

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.