id: PYSEC-2026-1187
published: "2026-07-07T11:45:23.401916Z"
modified: "2026-07-07T17:23:45.899603Z"
aliases:
- CVE-2023-27523
- GHSA-v594-2c97-hx38
summary: Apache Superset vulnerable to improper data authorization
details: |+
  Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

affected:
- package:
    name: apache-superset
    ecosystem: PyPI
    purl: pkg:pypi/apache-superset
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.1.1
  versions:
  - 0.34.0
  - 0.34.1
  - 0.35.1
  - 0.35.2
  - 0.36.0
  - 0.37.0
  - 0.37.1
  - 0.37.2
  - 0.38.0
  - 0.38.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.2.0
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.4.0
  - 1.4.1
  - 1.4.2
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.1.1rc1
  - 2.1.1rc2
  - 2.1.1rc3
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2023-27523
- type: PACKAGE
  url: https://github.com/apache/superset
- type: WEB
  url: https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h
- type: PACKAGE
  url: https://pypi.org/project/apache-superset
- type: ADVISORY
  url: https://github.com/advisories/GHSA-v594-2c97-hx38
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N