An improper authorization flaw in Apache Superset allows an authenticated user with limited write privileges to override the SQL query of an existing dataset when creating a new one. By doing so, the attacker can replace a protected query with one that exposes data they should not see, effectively bypassing the normal dataset‑level access controls. The vulnerability directly leads to confidentiality violations, as the attacker may retrieve sensitive or restricted information that would otherwise be inaccessible to their role.

Apache Superset versions prior to 6.0.0, managed by the Apache Software Foundation. The issue manifests when any user with the ability to write datasets and read charts performs a dataset creation that overwrites an existing dataset’s query. Consequently, all installations of Superset falling under this version range and granting such permissions are at risk.

The CVSS base score of 7.1 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% signifies a low likelihood of widespread exploitation at present. Despite its absence from the CISA KEV catalog, the vulnerability requires only authentication and basic dataset‑write rights, making it potentially exploitable within compromised or poorly audited environments. An attacker would access the vulnerable system, choose an existing dataset, overwrite its SQL with a query for restricted data, and then use the dataset as usual to read the information.