A vulnerability in Apache Superset’s Tag endpoint allows authenticated users, even those with low‑privilege roles such as Gamma, to retrieve sensitive authentication data. When the endpoint returns objects that include Users, the API response serializes password hashes (pbkdf2), email addresses, and login statistics. This exposure is a classic data‑confidentiality breach, identified as CWE‑200.

The affected product is Apache Superset, versions prior to 6.0.0. Users operating those versions with the Tag feature enabled—though disabled by default—are vulnerable to exposure of sensitive user information.

The CVSS score is 2.3, indicating low severity, and the EPSS score is under 1%, suggesting a minimal exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers need only authenticated access with a role such as Gamma; they can invoke the Tag REST API to pull the privileged data. No remote code execution or privilege escalation is required, but the data compromise could facilitate credential‑replay attacks or insider data leaks.