Apache Superset up to 5.x Validation Logic UpdateChartCommand privileges management

Summaryinfo

A vulnerability was found in Apache Superset up to 5.x. It has been classified as problematic. Impacted is the function UpdateChartCommand of the component Validation Logic. The manipulation leads to privileges management. This vulnerability is documented as CVE-2026-23981. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Apache Superset up to 5.x. This issue affects the function UpdateChartCommand of the component Validation Logic. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is integrity. The summary by CVE is:

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

It is possible to read the advisory at lists.apache.org. The identification of this vulnerability is CVE-2026-23981 since 01/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/30/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 6.0.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Superset

Version

• 5.x

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion