CVE-2023-40610

🗓️ 27 Nov 2023 10:22:41Reported by apacheType

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2023-40610	27 Nov 202314:06	–	circl
CNNVD	Apache Superset 安全漏洞	27 Nov 202300:00	–	cnnvd
CNVD	Apache Superset Authorization Issues Vulnerability (CNVD-2023-9666047)	30 Nov 202300:00	–	cnvd
Cvelist	CVE-2023-40610 Apache Superset: Privilege escalation with default examples database	27 Nov 202310:22	–	cvelist
EUVD	EUVD-2023-2955	3 Oct 202520:07	–	euvd
Github Security Blog	Duplicate Advisory: Apache Superset - Elevation of Privilege	27 Nov 202312:30	–	github
Github Security Blog	Apache Superset - Elevation of Privilege	28 Nov 202318:56	–	github
NVD	CVE-2023-40610	27 Nov 202311:15	–	nvd
OSV	BIT-SUPERSET-2023-40610 Apache Superset: Privilege escalation with default examples database	5 Feb 202507:27	–	osv
OSV	GHSA-392C-VJFV-H7WR Duplicate Advisory: Apache Superset - Elevation of Privilege	27 Nov 202312:30	–	osv

NVD

Vulners

Node

apache supersetRange<2.1.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.1.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot
github	www.github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5
openwall	www.openwall.com/lists/oss-security/2023/11/27/2

17 Jun 2026 06:18Current

7.6High risk

Vulners AI Score7.6

CVSS 3.16.3 - 8.8

EPSS0.01335

SSVC

CWE-863