[6.0.0] Embedded dashboard (guest): sorting a table triggers “Data error: Guest user cannot modify chart payload”

[HJulio]

Bug description

Summary

When viewing an embedded dashboard using a guest token, attempting to sort a table chart by clicking a column header causes the chart to fail with a “Data error” message. The error shown is:

Guest user cannot modify chart payload.

This makes sorting unusable for guest users in embedded contexts.

Environment

• Superset version: 6.0.0
• Deployment: Self-hosted
• Database: BigQuery
• Browser: Chrome
• Embedding method: Dashboard embedded via guest token (JWT)
• Chart type: Table chart (in a dashboard)

Steps to reproduce

1. Generate a guest token for a role/user that has access to the embedded dashboard.
2. Open the embedded dashboard as a guest user.
3. Locate a table chart in the dashboard.
4. Click on any column header to sort (ASC/DESC).

Actual result

• The chart displays a Data error popup / error state.
• Error message: “Guest user cannot modify chart payload.”
• Sorting does not work for guest users.

Expected result

Guest users should be able to sort table columns in embedded dashboards (client-side and/or server-side), without triggering permission errors (I mean, it's just sorting)

Additional notes

• This happens consistently (100% repro) for guest users in embedded mode.
• Sorting works as expected when logged in as a normal (non-guest) user.
• Two screenshots will be attached:
  1. The embedded dashboard/table before sorting
  2. The error after clicking a column header

Server Side Exception

2026-01-12 16:57:48,567:WARNING:superset.views.error_handling:SupersetErrorException
Traceback (most recent call last):
  File "/app/.venv/lib/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request
    rv = self.dispatch_request()
         ^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.11/site-packages/flask_appbuilder/security/decorators.py", line 109, in wraps
    return f(self, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/superset/views/base_api.py", line 120, in wraps
    duration, response = time_function(f, self, *args, **kwargs)
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/superset/utils/core.py", line 1410, in time_function
    response = func(*args, **kwargs)
               ^^^^^^^^^^^^^^^^^^^^^
  File "/app/superset/utils/log.py", line 304, in wrapper
    value = f(*args, **kwargs)
            ^^^^^^^^^^^^^^^^^^
  File "/app/superset/charts/data/api.py", line 239, in data
    command.validate()
  File "/app/superset/commands/chart/data/get_data_command.py", line 73, in validate
    self._query_context.raise_for_access()
  File "/app/superset/common/query_context.py", line 139, in raise_for_access
    self._processor.raise_for_access()
  File "/app/superset/common/query_context_processor.py", line 1246, in raise_for_access
    security_manager.raise_for_access(query_context=self._query_context)
  File "/app/superset/security/manager.py", line 2406, in raise_for_access
    raise SupersetSecurityException(
superset.exceptions.SupersetSecurityException: Guest user cannot modify chart payload

Attachments

• Screenshot 1: (before sorting)
• Screenshot 2: (error “Guest user cannot modify chart payload”)

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.11

Node version

I don't know

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hi @HJulio! I'm Dosu and I’m helping the superset team.

This behavior is intentional in Superset 6.0.0. When a guest user (using a guest token in an embedded dashboard) tries to sort a table chart, Superset detects this as a modification of the chart's payload—specifically, it changes the "orderby" field in the query context. The security logic is designed to prevent guest users from modifying the chart payload in any way, including sorting, filtering, or changing metrics/columns, to ensure that embedded dashboards remain immutable for guests. This restriction is enforced in the backend and is not configurable or bypassable via permissions or settings at this time. There are no documented workarounds or merged pull requests that relax this restriction for guest users in embedded dashboards. If you need guest users to be able to sort, you would need to consider a code customization or explore alternative embedding strategies with authenticated users instead.
Reference: superset/security/manager.py

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[HJulio]

Perhaps there should be a more granular way to allow guest users to interact with the dashboard? (e.g., allow sorting) Or maybe this should be a role?

In any case, I would appreciate it if someone could share a workaround.

Thank you!

[dosubot]

There isn't currently a way to allow guest users to interact more granularly with embedded dashboards (like enabling sorting) via roles or permissions. The restriction is enforced by hardcoded security logic: any modification to the chart payload—including sorting—triggers a security exception for guest users, regardless of their assigned role or permissions. Even with a custom guest role and all possible permissions, guest users are still blocked from modifying chart payloads in embedded dashboards, including sorting table columns [source][source].

To support more granular guest interactivity (like sorting only), the codebase would need changes—specifically in the logic that checks for query context modifications and enforces guest restrictions. There are no configuration flags, feature toggles, or workarounds available for this today.

If you need interactive features for embedded users, the only current alternative is to use authenticated users with restricted roles instead of guest tokens. This approach allows you to control permissions more flexibly, but it does require user authentication.

If you'd like to see this capability in the future, you might want to follow or participate in related feature discussions or proposals.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[rusackas]

This restriction is intentional security behavior: guest users in embedded contexts can't modify the chart payload (which includes re-sorting). Closing since it seems to be working as designed. Feel free to open a feature PR or Discussion if you'd like to propose more granular guest interaction controls.
Seems I was a bit hasty/confused here... my bad.

[HJulio]

This restriction is intentional security behavior: guest users in embedded contexts can't modify the chart payload (which includes re-sorting). Closing since it seems to be working as designed. Feel free to open a feature PR or Discussion if you'd like to propose more granular guest interaction controls.

Thanks. Just flagging that the fix is already in flight in #37371, and last week you asked there to get it merged after a rebase and a security pass (CC @dpgaspar @mistercrunch). So closing this as working-as-designed seems to conflict with that PR being active and on track to land.

The branch currently has conflicts, so the real blocker looks like the rebase plus the security review, not the behavior itself. Could we keep this open and linked to #37371 so it tracks until that merges?

[rusackas]

No problem, and sorry for the confusion. I'm trying like crazy to get the backlog down, and the interconnected PRs/Issues all over get... more than a little confusing at times.

Reopening, and I'll see if I can make sense of it all 🫠