CVE-2024-28148: Apache Superset

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

Affected products

• Apache Superset: before 4.0.0 (fixed in 4.0.0)

Published 2024-05-07. Last modified 2026-06-17.