CVE-2023-32672

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-326739.8Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable t CVE-2023-326749.8Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow.CVE-2023-326755.3Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, i CVE-2023-326767.2Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install a CVE-2023-326773.1Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can CVE-2023-326786.5Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to CVE-2023-326797.2Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote C CVE-2023-32687.1An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This CVE-2023-326809.6Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group CVE-2023-326816.1Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirect CVE-2023-326825.4Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactiva CVE-2023-326835.4Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_p