Home > Vulnerability Database > CVE-2025-27696

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2025-27696

Good to know:

Date: May 13, 2025

Apache Superset: Improper authorization leading to resource ownership takeover

Severity Score

8.8

Related Resources (6)

Url: http://www.openwall.com/lists/oss-security/2025/05/12/3

Url: https://lists.apache.org/thread/k2od03bxnxs6vcp80sr03ywcxl194413

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-27696

Url: https://github.com/apache/superset/commit/fc844d3dfdace890b32c00a507a959b81122b425

Url: https://github.com/apache/superset

Url: https://www.mend.io/vulnerability-database/CVE-2025-27696

Severity Score

8.8

Weakness Type (CWE)

Improper Authorization

CWE-285

Incorrect Authorization

CWE-863

Top Fix

Upgrade Version

Upgrade to version apache-superset - 4.1.2;apache-superset - 4.1.2;https://github.com/apache/superset.git - 4.1.2

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us