CVE-2024-53949 json
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
published last yr. modified 2mo ago also BIT-superset-2024-53949 , EUVD-2024-3416 , GHSA-35fc-9hrj-3585 , PYSEC-2026-1156
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.
issue affects Apache Superset: from 2.0.0 before 4.1.0.
Users are recommended to upgrade to version 4.1.0, which fixes the issue.
Patch / fix
- pypi apache-superset 4.1.0
- bitnami superset 4.1.1
- Apache Software Foundation Apache Superset 4.1.0
- apache superset 4.1.0
Is CVE-2024-53949 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-superset | >=2.0.0, <4.1.0 |
4.1.0 |
| bitnami | superset | >=2.0.0, <4.1.1 |
4.1.1 |
Affected products
- Apache Software Foundation Apache Superset
- apache superset
Classification
References
-
github.com
/apache/superset/commit/7650c47e72f28559e91524f5d68d50c2060df4c7
web
-
lists.apache.org
/thread/d3scbwmfpzbpm6npnzdw5y4owtqqyq8d
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2024/12/09/4
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-53949
advisory, web
-
github.com
/apache/superset
package
-
pypi.org
/project/apache-superset
package
-
github.com
/advisories/GHSA-35fc-9hrj-3585
advisory
Sources
- CVE List CVE-2024-53949
- GitHub Advisory GHSA-35fc-9hrj-3585
- NVD CVE-2024-53949
- OSV BIT-superset-2024-53949
- OSV PYSEC-2026-1156
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.