Medium
Apache Superset: Improper data permission validation on Jinja templated queries
Type: advisorySources: OSV
Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-27523
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 15:57 UTC · Revision 1
Source evidence
Apache Superset: Improper data permission validation on Jinja templated queries
core-osv · Original sourcePublished 6 Sept 2023, 12:55 UTC
Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.
osv:CVE-2023-27523
Complete source record
{
"id": "ab32d249e0475dc67e0c1a556952ba646bc4e2262808455e9b5f9dfdf0c3d5f6",
"url": "https://osv.dev/vulnerability/CVE-2023-27523",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache Superset: Improper data permission validation on Jinja templated queries",
"summary": "Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.",
"evidence": "osv:CVE-2023-27523",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-27523",
"aliases": [
"BIT-superset-2023-27523",
"CVE-2023-27523",
"GHSA-v594-2c97-hx38",
"PYSEC-2026-1187"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/superset",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2817aebd69dc7d199ec45d973a2079f35e5658b6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.1.0rc3",
"2.1.0",
"2.1.0rc2",
"superset-helm-chart-0.8.6",
"superset-helm-chart-0.8.5",
"superset-helm-chart-0.8.4",
"superset-helm-chart-0.8.3",
"superset-helm-chart-0.8.2",
"superset-helm-chart-0.8.1",
"superset-helm-chart-0.8.0",
"superset-helm-chart-0.7.7",
"superset-helm-chart-0.7.6",
"superset-helm-chart-0.7.4",
"superset-helm-chart-0.7.3",
"superset-helm-chart-0.7.2",
"superset-helm-chart-0.7.1",
"superset-helm-chart-0.7.0",
"superset-helm-chart-0.6.6",
"superset-helm-chart-0.6.5",
"superset-helm-chart-0.6.4",
"superset-helm-chart-0.6.3",
"superset-helm-chart-0.6.2",
"superset-helm-chart-0.6.1",
"superset-helm-chart-0.6.0",
"superset-helm-chart-0.5.10",
"superset-helm-chart-0.5.9",
"superset-helm-chart-0.5.8",
"superset-helm-chart-0.5.7",
"superset-helm-chart-0.5.6",
"superset-helm-chart-0.5.5",
"superset-helm-chart-0.5.4",
"superset-helm-chart-0.5.3",
"superset-helm-chart-0.5.2",
"superset-helm-chart-0.5.1",
"superset-helm-chart-0.5.0",
"superset-helm-chart-0.4.0",
"superset-helm-chart-0.3.12",
"v2021.40.0",
"superset-helm-chart-0.3.11",
"v2021.41.0",
"superset-helm-chart-0.3.10",
"superset-helm-chart-0.3.9",
"v2021.38.0",
"v2021.36.5",
"superset-helm-chart-0.3.8",
"superset-helm-chart-0.3.7",
"v2021.36.0",
"v2021.35.0",
"v2021.34.0",
"superset-helm-chart-0.3.6",
"v2021.31.0",
"v2021.29.0",
"superset-helm-chart-0.3.5",
"v2021.27.1",
"v2021.27.0",
"superset-helm-chart-0.3.4",
"superset-helm-chart-0.3.3",
"superset-helm-chart-0.3.2",
"superset-helm-chart-0.3.1",
"superset-helm-chart-0.3.0",
"superset-helm-chart-0.2.1",
"superset-helm-chart-0.2.0",
"v2021.25.0",
"superset-helm-chart-0.1.6",
"superset-helm-chart-0.1.5",
"v2021.23.1",
"v2021.24.0",
"superset-helm-chart-0.1.4",
"v2021.23.0",
"v2021.21.0",
"v2021.22.0",
"superset-helm-chart-0.1.3",
"v2021.19.0",
"v2021.20.0",
"v2021.18.0",
"v2021.17.0",
"superset-helm-chart-0.1.2",
"v2021.15.0",
"superset-helm-chart-0.1.1",
"superset-helm-chart-0.1.0",
"v2021.13.0",
"v2021.10.0",
"v2021.9.4",
"v2021.8.0",
"v2021.9.0",
"v2021.7.0",
"v2021.6.0",
"v2021.5.1",
"v2021.5.0",
"v2021.3.0",
"2020.51.1",
"v2020.51.0",
"test_tag",
"0.29.0rc1",
"0.25-fork",
"0.20.1",
"0.19.1",
"0.18.5",
"0.18.4",
"0.18.3",
"0.18.2",
"0.17.6",
"0.17.5",
"0.17.4",
"0.17.3",
"0.17.2",
"0.17.1",
"airbnb_prod.0.15.5.0",
"0.17.0",
"0.16.1",
"0.16.0",
"airbnb_prod.0.15.4.2",
"airbnb_prod.0.15.4.1",
"0.15.4.1",
"0.15.4",
"0.15.3",
"0.15.1",
"airbnb_prod.0.15.0.1",
"0.15.0",
"airbnb_prod.0.13.0.3",
"airbnb_prod.0.13.0.2",
"airbnb_prod.0.13.0.1",
"0.14.1",
"airbnb_prod.0.13.0.0",
"airbnb_prod.0.12.1.0",
"airbnb_prod.0.12.0.1",
"0.13.2",
"0.13.1",
"0.12.0",
"airbnb_prod.0.11.0.6",
"airbnb_prod.0.11.0.5",
"airbnb_prod.0.11.0.4",
"airbnb_prod.0.11.0.3",
"dummy",
"airbnb_prod.0.11.0.2",
"airbnb_prod.0.11.0.1",
"0.11.0",
"airbnb_prod.0.10.0.2",
"0.10.0",
"0.9.1",
"0.9.0",
"0.8.9",
"0.8.8",
"0.8.7",
"0.8.6",
"0.8.5",
"0.8.4",
"0.8.3",
"0.8.0",
"0.7.0",
"0.6.1",
"0.6.0",
"0.5.3",
"0.5.2",
"0.5.1",
"rm",
"0.5.0",
"0.4.0",
"0.2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27523.json"
}
}
],
"modified": "2026-10-28T02:30:36.930891001Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27523.json",
"https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h",
"https://nvd.nist.gov/vuln/detail/CVE-2023-27523"
],
"provider_metadata": {
"cwe_ids": [
"CWE-863"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"last_affected": "2.1.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27523.json"
}
},
"related_cves": [
{
"value": "CVE-2023-27523",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504380,
"published_at": "2023-09-06T12:55:31.286+00:00"
}