Threats tagged 'bit-superset-2024-55633'

Apache Superset before version 4.1.0 contains an improper authorization vulnerability in SQLLab when used with Postgres analytic databases. An attacker with SQLLab access can craft a SQL DML statement that is incorrectly identified as read-only, allowing unauthorized write operations. This issue does not affect non-Postgres analytic databases or Postgres connections configured with a read-only user. The vulnerability is fixed in Apache Superset version 4.1.0.