# What changed in apache-superset

> 4 changes in apache-superset 6 from its official release notes, upgrade guides and advisories: 4 security. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/pypi/apache-superset/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## apache-superset 6

### Security

- Apache Superset allows authenticated users to view sensitive data without explicit permissions (6.0.0) — [security advisory](https://github.com/advisories/GHSA-H294-8FXM-M2PJ)
- Apache Superset allows privileged users to conduct error-based SQL Injection (6.0.0) — [security advisory](https://github.com/advisories/GHSA-GVXG-9HQX-F4RG)
- Apache Superset Improper Authorization allows low-privileged users to bypass access controls (6.0.0) — [security advisory](https://github.com/advisories/GHSA-3M2G-V7JF-7FXC)
- Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections (6.0.0) — [security advisory](https://github.com/advisories/GHSA-MWF2-QR4V-94H2)