CVE-2025-55674

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-556756.5Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenti CVE-2025-556765.5Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose informati CVE-2025-556777.8Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.CVE-2025-556787.0Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.CVE-2025-556794.7Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.CVE-2025-55685.4The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including CVE-2025-556807.0Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privile CVE-2025-556817.8Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally.CVE-2025-556824.6Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physica CVE-2025-556835.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-556847.0Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-556857.0Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.