An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

Affected Packages

PyPI apache-superset

Affected versions: 0 (last affected: 2.1.0)

Related CVEs

CVE-2023-36387

Key Information

GHSA ID

GHSA-9832-mgg4-3gr6

Published

September 6, 2023 3:30 PM

Last Modified

September 7, 2023 1:59 PM

CVSS Score

5.0 /10

Primary Ecosystem

PyPI

Primary Package

apache-superset

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 27, 2025 6:35 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.