CVE-2026-23981: 
Apache Superset vulnerability analysis and mitigation

CVE-2026-23981 is an Improper Authorization vulnerability in Apache Superset that allows an authenticated user with chart-update permissions to associate charts with dashboards they do not own or have write access to. The flaw affects all Apache Superset versions before 6.0.0 and was publicly disclosed on July 30, 2026, via the Apache security mailing list and oss-security. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, oss-security).

The root cause is CWE-285 (Improper Authorization): the UpdateChartCommand in Apache Superset's REST API fails to verify that the requesting user holds write permissions on the target dashboards supplied in the dashboards field of the request body. An authenticated attacker with only chart-update privileges can craft a PUT/PATCH request to the chart REST API endpoint, supplying arbitrary dashboard IDs, and the server will associate the chart with those dashboards without performing an ownership or permission check on them. No special configuration or elevated privileges beyond a standard authenticated account with chart-update rights are required (GitHub Advisory, oss-security).

Successful exploitation allows an attacker to modify the content and structure of dashboards they do not own by injecting unauthorized chart associations, undermining dashboard integrity and access control boundaries. There is no confidentiality or availability impact — the vulnerability is limited to a low integrity impact on the vulnerable system. While lateral movement and data exfiltration are not directly enabled, unauthorized dashboard modification could be used to mislead other users or embed misleading visualizations in sensitive business dashboards (GitHub Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.26–0.36%, placing it in roughly the 29th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authenticate: Obtain valid credentials for an Apache Superset account that has been granted chart-update (can write charts) permissions but lacks write access to the target dashboard.
2. Identify target dashboard IDs: Browse the Superset UI or query the /api/v1/dashboard/ REST endpoint to enumerate dashboard IDs belonging to other users or teams.
3. Identify a chart to update: Select or create a chart owned by the attacker's account, noting its chart ID.
4. Craft a malicious API request: Send a PUT or PATCH request to /api/v1/chart/<chart_id> with a JSON body that includes the dashboards field populated with the IDs of dashboards the attacker does not own, e.g.:

   {
     "dashboards": [42, 99]
   }

5. Bypass authorization: Because UpdateChartCommand does not validate write permissions on the specified dashboard IDs, the server processes the request and associates the chart with the target dashboards.
6. Confirm unauthorized modification: Verify that the chart now appears on the target dashboards, confirming the authorization bypass (GitHub Advisory, oss-security).

• Network/API Logs: REST API requests (PUT or PATCH) to /api/v1/chart/<id> from users who do not own the dashboards referenced in the dashboards field of the request body.
• Application Logs: Superset access logs showing chart update operations where the authenticated user's account is not listed as an owner or editor of the target dashboard IDs.
• Behavioral: Unexpected chart-to-dashboard associations appearing in dashboards owned by other users or teams, particularly involving charts owned by lower-privileged accounts.
• Audit Trail: Discrepancies between dashboard ownership records and the list of charts associated with those dashboards in the Superset metadata database (dashboard_slices table).

Upgrade Apache Superset to version 6.0.0 or later, which contains the fix for this vulnerability (oss-security, GitHub Advisory). As an interim workaround if immediate patching is not feasible, restrict chart-update permissions to only trusted users and monitor the REST API for suspicious chart update requests that reference dashboards not owned by the requesting user. Reviewing and auditing existing dashboard-chart associations for unauthorized changes is also recommended.

The vulnerability was reported by Đỗ Thành Đạt and remediated by Daniel Gaspar of the Apache Superset project, who disclosed it via the oss-security mailing list on July 30, 2026 (oss-security). No significant broader media coverage, researcher commentary, or notable social media discussion has been identified beyond standard CVE aggregator coverage.