CVE-2025-55675

Affected versions of the Apache Superset package are vulnerable to Improper Authorization due to insufficient access control in endpoints that allow ownership transfer. The API endpoints for dashboards, charts, and datasets fail to enforce proper authorization checks on ownership-related attributes, enabling authenticated read‑permission users to manipulate ownership. An attacker who is authenticated with only read permissions can exploit this by crafting requests to these endpoints to take over ownership of dashboards, charts or datasets, compromising data integrity, confidentiality, and availability.