CVE-2024-55633 is an improper authorization vulnerability in Apache Superset's SQLLab component affecting Postgres analytic databases. The flaw allows an attacker with SQLLab access to execute specially crafted SQL DML statements that bypass the intended read-only query validation, resulting in unauthorized write access. Non-Postgres analytic databases and Postgres connections configured with a read-only user are not vulnerable. The issue affects all Apache Superset versions before 4.1.0 and is resolved by upgrading to version 4.1.0.

An attacker with SQLLab access on a Postgres analytic database can perform unauthorized write operations by exploiting incorrect read-only query validation. This could lead to unauthorized data modification within the affected database. Other database types or properly configured Postgres read-only users are not impacted.

Users should upgrade Apache Superset to version 4.1.0 or later, where this vulnerability is fixed. Additionally, configuring Postgres analytic database connections with a read-only user prevents exploitation. No other mitigation is indicated by the vendor advisory.