CVE-2019-12413: Users able to query database metadata in Apache Superset

The vulnerability stems from insufficient access control in metadata query handling. While exact patch details are unavailable, Superset's architecture suggests two likely candidates: 1) Schema/metadata retrieval functions (like get_all_table_names_in_schema) that didn't validate user permissions on the target database. 2) The SQL execution endpoint (SqlApiView) that processed raw queries without applying the same database access checks used in other UI contexts. The medium confidence reflects the lack of direct commit evidence, but aligns with the described attack vector and Superset's component structure.