This is an automated email from the ASF dual-hosted git repository.
aminghadersohi pushed a commit to branch work-pr-39604
in repository https://gitbox.apache.org/repos/asf/superset.git
The following commit(s) were added to refs/heads/work-pr-39604 by this push:
new 525d4f67a8c fix(security): add ApiKey to ADMIN_ONLY_VIEW_MENUS
525d4f67a8c is described below
commit 525d4f67a8cecdbffec2540e4049f0d180cf1262
Author: Amin Ghadersohi <[email protected]>
AuthorDate: Thu May 28 15:25:01 2026 +0000
fix(security): add ApiKey to ADMIN_ONLY_VIEW_MENUS
FAB registers an ApiKeyApi view menu when FAB_API_KEY_ENABLED=True.
Without this entry any non-admin role could reach API key management
endpoints via the standard permission check in is_admin_only_view.
---
superset/security/manager.py | 2 ++
1 file changed, 2 insertions(+)
diff --git a/superset/security/manager.py b/superset/security/manager.py
index 30c3dc41c65..8d2476714e3 100644
--- a/superset/security/manager.py
+++ b/superset/security/manager.py
@@ -463,6 +463,8 @@ class SupersetSecurityManager( # pylint:
disable=too-many-public-methods
"PermissionViewMenu",
"ViewMenu",
"User",
+ # FAB registers ApiKeyApi when FAB_API_KEY_ENABLED=True
+ "ApiKey",
} | USER_MODEL_VIEWS
ALPHA_ONLY_VIEW_MENUS = {
