Vulnerability Bulletins |
CVE-2025-48912 |
|
| Affected software | APACHE |
|
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. |
|
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2025-48912 | |