CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2023-27523
Medium (4.3) in apache superset. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in apache-superset 2.1.1.
Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:superset
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v594-2c97-hx38 | PyPI | apache-superset | <=2.1.0 | no fix published |
| PYSEC-2026-1187 | PyPI | apache-superset | <2.1.1 | 2.1.1 |