https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:17:49.580806+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-55675 CVE-2025-55675 — Apache Superset: Incorrect datasource authorization on REST API 2026-10-03T11:17:49.582636+00:00

Affected: Apache Software Foundation Apache Superset

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-mhpq-m962-mg92 GHSA-mhpq-m962-mg92 — Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access 2026-10-03T11:17:49.582692+00:00

Affected: PyPI: apache-superset

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.