Skip to content
Heist/ feed
Back to feed
Medium

Apache Superset: SQL parser edge case bypasses data access authorization

Type: advisorySources: OSV

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-32672
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 16:22 UTC · Revision 1

Source evidence

Apache Superset: SQL parser edge case bypasses data access authorization

core-osv · Original source

Published 6 Sept 2023, 13:16 UTC

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

osv:CVE-2023-32672
Complete source record
{
  "id": "e51f331d5f98dab97978edb400a459a41cbcfa099a9200f23896220863e5889b",
  "url": "https://osv.dev/vulnerability/CVE-2023-32672",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Apache Superset: SQL parser edge case bypasses data access authorization",
    "summary": "An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.",
    "evidence": "osv:CVE-2023-32672",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2023-32672",
      "aliases": [
        "BIT-superset-2023-32672",
        "CVE-2023-32672",
        "GHSA-95ch-p3gw-23qg",
        "PYSEC-2026-1166"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/apache/superset",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "2817aebd69dc7d199ec45d973a2079f35e5658b6"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.1.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "2.1.0rc3",
            "2.1.0",
            "2.1.0rc2",
            "superset-helm-chart-0.8.6",
            "superset-helm-chart-0.8.5",
            "superset-helm-chart-0.8.4",
            "superset-helm-chart-0.8.3",
            "superset-helm-chart-0.8.2",
            "superset-helm-chart-0.8.1",
            "superset-helm-chart-0.8.0",
            "superset-helm-chart-0.7.7",
            "superset-helm-chart-0.7.6",
            "superset-helm-chart-0.7.4",
            "superset-helm-chart-0.7.3",
            "superset-helm-chart-0.7.2",
            "superset-helm-chart-0.7.1",
            "superset-helm-chart-0.7.0",
            "superset-helm-chart-0.6.6",
            "superset-helm-chart-0.6.5",
            "superset-helm-chart-0.6.4",
            "superset-helm-chart-0.6.3",
            "superset-helm-chart-0.6.2",
            "superset-helm-chart-0.6.1",
            "superset-helm-chart-0.6.0",
            "superset-helm-chart-0.5.10",
            "superset-helm-chart-0.5.9",
            "superset-helm-chart-0.5.8",
            "superset-helm-chart-0.5.7",
            "superset-helm-chart-0.5.6",
            "superset-helm-chart-0.5.5",
            "superset-helm-chart-0.5.4",
            "superset-helm-chart-0.5.3",
            "superset-helm-chart-0.5.2",
            "superset-helm-chart-0.5.1",
            "superset-helm-chart-0.5.0",
            "superset-helm-chart-0.4.0",
            "superset-helm-chart-0.3.12",
            "v2021.40.0",
            "superset-helm-chart-0.3.11",
            "v2021.41.0",
            "superset-helm-chart-0.3.10",
            "superset-helm-chart-0.3.9",
            "v2021.38.0",
            "v2021.36.5",
            "superset-helm-chart-0.3.8",
            "superset-helm-chart-0.3.7",
            "v2021.36.0",
            "v2021.35.0",
            "v2021.34.0",
            "superset-helm-chart-0.3.6",
            "v2021.31.0",
            "v2021.29.0",
            "superset-helm-chart-0.3.5",
            "v2021.27.1",
            "v2021.27.0",
            "superset-helm-chart-0.3.4",
            "superset-helm-chart-0.3.3",
            "superset-helm-chart-0.3.2",
            "superset-helm-chart-0.3.1",
            "superset-helm-chart-0.3.0",
            "superset-helm-chart-0.2.1",
            "superset-helm-chart-0.2.0",
            "v2021.25.0",
            "superset-helm-chart-0.1.6",
            "superset-helm-chart-0.1.5",
            "v2021.23.1",
            "v2021.24.0",
            "superset-helm-chart-0.1.4",
            "v2021.23.0",
            "v2021.21.0",
            "v2021.22.0",
            "superset-helm-chart-0.1.3",
            "v2021.19.0",
            "v2021.20.0",
            "v2021.18.0",
            "v2021.17.0",
            "superset-helm-chart-0.1.2",
            "v2021.15.0",
            "superset-helm-chart-0.1.1",
            "superset-helm-chart-0.1.0",
            "v2021.13.0",
            "v2021.10.0",
            "v2021.9.4",
            "v2021.8.0",
            "v2021.9.0",
            "v2021.7.0",
            "v2021.6.0",
            "v2021.5.1",
            "v2021.5.0",
            "v2021.3.0",
            "2020.51.1",
            "v2020.51.0",
            "test_tag",
            "0.29.0rc1",
            "0.25-fork",
            "0.20.1",
            "0.19.1",
            "0.18.5",
            "0.18.4",
            "0.18.3",
            "0.18.2",
            "0.17.6",
            "0.17.5",
            "0.17.4",
            "0.17.3",
            "0.17.2",
            "0.17.1",
            "airbnb_prod.0.15.5.0",
            "0.17.0",
            "0.16.1",
            "0.16.0",
            "airbnb_prod.0.15.4.2",
            "airbnb_prod.0.15.4.1",
            "0.15.4.1",
            "0.15.4",
            "0.15.3",
            "0.15.1",
            "airbnb_prod.0.15.0.1",
            "0.15.0",
            "airbnb_prod.0.13.0.3",
            "airbnb_prod.0.13.0.2",
            "airbnb_prod.0.13.0.1",
            "0.14.1",
            "airbnb_prod.0.13.0.0",
            "airbnb_prod.0.12.1.0",
            "airbnb_prod.0.12.0.1",
            "0.13.2",
            "0.13.1",
            "0.12.0",
            "airbnb_prod.0.11.0.6",
            "airbnb_prod.0.11.0.5",
            "airbnb_prod.0.11.0.4",
            "airbnb_prod.0.11.0.3",
            "dummy",
            "airbnb_prod.0.11.0.2",
            "airbnb_prod.0.11.0.1",
            "0.11.0",
            "airbnb_prod.0.10.0.2",
            "0.10.0",
            "0.9.1",
            "0.9.0",
            "0.8.9",
            "0.8.8",
            "0.8.7",
            "0.8.6",
            "0.8.5",
            "0.8.4",
            "0.8.3",
            "0.8.0",
            "0.7.0",
            "0.6.1",
            "0.6.0",
            "0.5.3",
            "0.5.2",
            "0.5.1",
            "rm",
            "0.5.0",
            "0.4.0",
            "0.2.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32672.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.321568064Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32672.json",
        "https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-32672"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "cna_assigner": "apache",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "last_affected": "2.1.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32672.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-32672",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497319,
  "published_at": "2023-09-06T13:16:02.396+00:00"
}