An improper authorization flaw in Apache Superset allows an authenticated user with chart update rights to modify dashboards that they do not own. The vulnerability exists because the UpdateChartCommand accepts a list of dashboard IDs in the request body but does not validate that the user has write permissions on those dashboards. As a result, an attacker can move a chart onto any dashboard and potentially expose or alter sensitive information.

All installations of Apache Superset prior to version 6.0.0 are affected. The issue applies to deployments where a user is granted permission to update charts but does not have permission to edit the target dashboards. The scope includes environments using the default authentication and role configuration, although the presence of these roles is inferred and not explicitly confirmed by the advisory.

The CVSS score of 5.3 indicates a medium severity vulnerability, and the EPSS score of < 1% shows a low likelihood of exploitation at this time. It is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with chart‑update privileges who can access the Superset REST API. Attackers can permanently alter dashboards or expose sensitive data, but no public exploit has been reported. The absence of an authorization check means that a legitimate user could leverage the API to affect dashboards they do not own.