Threats tagged 'ghsa-9g5x-mm39-wg9r'

Apache Superset versions before 4.1.3 improperly disclose database schema information to low-privileged guest users. Specifically, when a guest user accesses a chart, the API response from the /chart/data endpoint includes a query field that reveals underlying query details such as table names. This information disclosure vulnerability is fixed in version 4.1.3.post1.