CVE-2025-55675

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.

• CWE-285

• https://lists.apache.org/thread/op681b4kbd7g84tfjf9omz0sxggbcv33Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/08/14/6

Published

Aug 14, 2025

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5567The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…5.4
• CVE-2025-55670On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kub…7.1
• CVE-2025-55671Uncontrolled search path element issue exists in TkEasyGUI v…8.5
• CVE-2025-55672A stored Cross-Site Scripting (XSS) vulnerability exists in …5.4
• CVE-2025-55673When a guest user accesses a chart in Apache Superset, the A…4.3
• CVE-2025-55674A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in…6.5
• CVE-2025-55676Generation of error message containing sensitive information…5.5
• CVE-2025-55677Untrusted pointer dereference in Windows Device Association …7.8
• CVE-2025-55678Use after free in Windows DirectX allows an authorized attac…7
• CVE-2025-55679Improper input validation in Windows Kernel allows an unauth…4.7
• CVE-2025-5568The WpEvently plugin for WordPress is vulnerable to Stored C…5.4
• CVE-2025-55680Time-of-check time-of-use (toctou) race condition in Windows…7