-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-superset | pip | < 2.1.3 | 2.1.3 |
| apache-superset | pip | >= 3.0.0, < 3.0.2 | 3.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the removed update_charts_owners function shown in the commit diff. This function was called during dashboard creation/update operations to synchronize chart ownership. The security fix explicitly removes this function and its usage patterns (in create.py and update.py), indicating it was the source of improper authorization. The CWE-863 classification and patch description confirm this was an authorization flaw where low-privilege users could gain write access through ownership propagation.
PythonPythonKEV Misses 88% of Exploited CVEs- Get the report