Loading story…
Apache Superset disclosed CVE-2026-23981, an improper authorization vulnerability that allows an authenticated user with permission to update charts to alter dashboards they do not own. The issue affects all Superset versions before 6.0.0 and can be exploited through the REST API by supplying dashboard IDs in a chart update request, effectively linking chart-edit privileges to unauthorized dashboard modification.
The flaw was traced to missing write-permission validation in UpdateChartCommand for target dashboards included in the request body. Apache said the issue is fixed in Superset 6.0.0 and credited Đỗ Thành Đạt for reporting the bug and Daniel Gaspar for developing the remediation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache Superset disclosed CVE-2026-23981, an improper authorization vulnerability affecting all versions before 6.0.0. The flaw allows an authenticated user with permission to update charts to modify dashboards they do not own via the REST API because write-permission validation was missing for target dashboards in UpdateChartCommand.
Apache stated that upgrading to version 6.0.0 remediates CVE-2026-23981. The fix addresses the missing authorization check that allowed unauthorized dashboard modification through chart update requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public proof-of-concept exploit code is available for **CVE-2026-23980**, an authenticated error-based SQL injection vulnerability affecting Apache Superset versions before `6.0.0`. An attacker with read-level access can submit crafted `sqlExpression` and `where` parameter values to trigger database errors, potentially exposing backend query details, database structure, and sensitive metadata. Apache remediated the issue in Superset `6.0.0`; organizations should upgrade affected deployments promptly. Security teams should also review low-privilege Superset accounts and inspect application, proxy, and database logs for malformed requests involving the affected parameters and anomalous database-error activity, as public exploit availability is likely to increase probing of unpatched internet-exposed instances.
Sep 16, 2026
Apache disclosed **CVE-2026-45249**, an important-severity cross-site scripting flaw in Apache ECharts that affects versions prior to **6.1.0**. The vulnerability is in the **Lines** series tooltip rendering path and is triggered when tooltips are enabled, no custom `tooltip.formatter` is defined, and `series.data[i].name` contains raw HTML that is inserted into the page through an `innerHTML` sink instead of being escaped. Successful exploitation can lead to arbitrary JavaScript execution in a victim’s browser, creating risks including session token theft and account hijacking. Apache said the issue breaks the expected behavior of built-in tooltip formatting and has remediated it in **Apache ECharts 6.1.0**; users relying on Lines series tooltips are being urged to upgrade. The vulnerability was credited to **Lakshmikanthan K** and disclosed by **Zhongxiang Wang** on the oss-sec mailing list.
Jun 29, 2026
Two high-severity vulnerabilities in **Chartbrew 4.9.0** allowed authenticated users with access to one project in a team to interfere with resources belonging to other projects in the same team. In `CVE-2026-40904`, dataset and `dataRequest` routes relied on team-scoped permission checks instead of confirming that the referenced `dataset_id`, `dataRequest` ID, and `connection_id` belonged to projects the user was authorized to access. That flaw exposed cross-project datasets and data requests to unauthorized read, execute, create, update, and delete actions, and could also enable misuse of victim-side database or API connections. A second flaw, tracked as `CVE-2026-40600`, affected Chartbrew's project share policy routes. The application validated the project in the URL path but did not ensure the supplied `policy_id` was tied to that project, allowing users to update or delete **SharePolicy** records from other projects. Attackers could therefore change dashboard sharing settings such as visibility, password protection, allowed parameters, and expiration rules across project boundaries. Both issues were fixed in **Chartbrew 5.0.0**.
Jun 29, 2026