Bob124 opened a new issue, #46003:
URL: https://github.com/apache/superset/issues/46003
### Bug description
### Bug description
A user who has access to a dashboard **only through dashboard roles**
(DASHBOARD_RBAC
enabled, dashboard has roles assigned) but has **no dataset permission**
cannot open
a chart in Explore.
- Superset 4.0.2: the Explore page loads the chart normally; the user can
swap the
dataset to one they own and use "Save as" to copy the chart.
- Superset 6.1.0: the page loads completely empty (no chart, no controls),
and
swapping the dataset does not help, because the original form_data is
already gone.
`GET /api/v1/explore/?dashboard_page_id=...&slice_id=N` returns **403**.
This contradicts the documented behaviour: with DASHBOARD_RBAC, granting a
role
access to a dashboard "bypasses dataset-level checks and implicitly grants
read
access to all charts and associated datasets within the dashboard".
I am **not** asking to relax the check added by #32679 (CVE-2025-55675). I am
reporting that the dashboard-RBAC exemption cannot be reached on this code
path.
### Root cause
`superset/commands/explore/get.py` runs the authorization check **before**
merging
the request params, and **without** passing form_data:
```python
if datasource:
datasource_name = datasource.name
security_manager.raise_for_access(datasource=datasource) # no
form_data=
...
utils.merge_request_params(form_data, request.args) # runs later
```
`SupersetSecurityManager.raise_for_access()` derives `form_data` only from
`query_context` or `viz`:
```python
if datasource or query_context or viz:
form_data = None
if query_context:
form_data = query_context.form_data
elif viz:
form_data = viz.form_data
```
The dashboard-RBAC branch then requires
`form_data and (dashboard_id := form_data.get("dashboardId")) and
DASHBOARD_RBAC and ...`,
so with `form_data is None` it short-circuits and the user falls through to
the
per-dataset check → 403.
On the frontend, `src/pages/Chart/index.tsx` handles the 403 by hydrating
with
`fallbackExploreInitialData` (empty columns/metrics), which is why the page
renders
blank and "swap dataset" cannot restore anything.
Also note `SliceHeader` only puts `dashboard_page_id` in the Explore URL —
never
`dashboard_id`. The dashboard id only exists in the frontend's
`DashboardExploreContext` in localStorage, so it is not available to the API
call
at load time.
4.0.2 appeared to work because the legacy `/superset/explore/` view
performed no
access check during page load at all — that is exactly CVE-2025-55675.
### Expected behavior
A user with dashboard access via dashboard roles can open the chart in
Explore,
with the chart config loaded, and can swap the dataset / Save as.
### Actual behavior
Blank Explore page; 403 from `/api/v1/explore/`; chart config lost.
### Suggested fix (either is fine)
1. Backend: pass the already-available dashboard context into the check, e.g.
`raise_for_access(datasource=datasource, dashboard_id=...)`, or pass a
`form_data` carrying `dashboardId` so the existing exemption branch can
run.
2. Frontend: include `dashboard_id` in the Explore URL from `SliceHeader`,
so the
API call can resolve the dashboard and evaluate the exemption.
### Steps to reproduce
1. Enable `DASHBOARD_RBAC`.
2. Create role `R`, dataset `D` (owned by admin), chart `C` on `D`,
dashboard `B`
containing `C`. Assign role `R` to `B`. Do **not** grant `R` any
permission on `D`.
3. Create user `U` with role `R`. Confirm `U` can view dashboard `B` and its
charts.
4. As `U`, open dashboard `B`, click `Edit chart` on `C`.
5. Observe: empty Explore page; Network shows `403` on `GET
/api/v1/explore/`.
### Superset version
6.1.0
### Python version
3.11
### Node version
20
### Browser
Chrome
### Additional context
FEATURE_FLAGS = {"DASHBOARD_RBAC": True}
Related: #32679 (CVE-2025-55675 fix — the reason the check exists),
#34129 (missing-dataset UI for the same denial), #31938 (dashboard RBAC needs
formData.dashboardId), #43987 (another path where form_data is None and the
dashboard-RBAC branch is unreachable), #43458 (denial kind collapsing on the
form_data_key path).
### Screenshots/recordings
_No response_
### Superset version
6.1.0
### Python version
3.11
### Node version
18 or greater
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to
my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug
report.
- [x] I have checked Superset's logs for errors and if I found a relevant
Python stacktrace, I included it here as text in the "additional context"
section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
