-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-superset | pip | < 2.1.2 | 2.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) SQL Lab's query execution mechanism (execute_sql_statement) failed to properly validate write operations in CTE statements against authorization policies, and 2) The database connection configuration (via get_sqla_engine) granted excessive privileges to the examples database. The PoC demonstrates that attackers could modify ab_user/ab_user_role tables through crafted CTE queries, indicating missing authorization checks in query execution and improper database access configuration.