6.0.0rc2-Security-Base Permissions and Permission on Views/Menus click "Internal server error"

Bug description

Version：6.0.0rc2
Operation：Settings->Manage->Plugins->Security->Base Permissions or Permission on Views/Menus
Incorrectly operated route：/permissions/list/, /permissionviews/list/
Other descriptions：These two functions are normal in other versions, but clicking on them is incorrect in this version. Have there been any other destructive changes or configurations?

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.11

Node version

18 or greater

Browser

Chrome

Additional context

This is the background log when you click "Base Permissions"：
2025-11-17 15:25:22,090:WARNING:superset.views.error_handling:Exception
Traceback (most recent call last):
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\app.py", line 1484, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\app.py", line 1469, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\security\decorators.py", line 151, in wraps
return f(self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\views.py", line 205, in list
return self.render_template(
^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\baseviews.py", line 346, in render_template
return render_template(
^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 151, in render_template
return _render(app, template, context)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 132, in _render
rv = template.render(context)
^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\jinja2\environment.py", line 1295, in render
self.environment.handle_exception()
File "C:\superset-dev\superset-60-env\Lib\site-packages\jinja2\environment.py", line 942, in handle_exception
raise rewrite_traceback_stack(source=source)
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\general\model\list.html", line 2, in top-level template code
{% import 'appbuilder/general/lib.html' as lib %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\base.html", line 1, in top-level template code
{% extends base_template %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\baselayout.html", line 2, in top-level template code
{% import 'appbuilder/baselib.html' as baselib %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\init.html", line 42, in top-level template code
{% block body %}
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\baselayout.html", line 19, in block 'body'
{% block content %}
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\general\model\list.html", line 13, in block 'content'
{% block list_list scoped %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\general\model\list.html", line 15, in block 'list_list'
{{ widgets.get('list')()|safe }}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\widgets.py", line 33, in call
template = jinja_env.get_template(self.template)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 64, in get_source
return self._get_source_fast(environment, template)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 98, in _get_source_fast
raise TemplateNotFound(template)
jinja2.exceptions.TemplateNotFound: superset/fab_overrides/list.html
2025-11-17 15:25:22,091:ERROR:superset.views.error_handling:superset/fab_overrides/list.html
Traceback (most recent call last):
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\app.py", line 1484, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\app.py", line 1469, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\security\decorators.py", line 151, in wraps
return f(self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\views.py", line 205, in list
return self.render_template(
^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\baseviews.py", line 346, in render_template
return render_template(
^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 151, in render_template
return _render(app, template, context)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 132, in _render
rv = template.render(context)
^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\jinja2\environment.py", line 1295, in render
self.environment.handle_exception()
File "C:\superset-dev\superset-60-env\Lib\site-packages\jinja2\environment.py", line 942, in handle_exception
raise rewrite_traceback_stack(source=source)
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\general\model\list.html", line 2, in top-level template code
{% import 'appbuilder/general/lib.html' as lib %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\base.html", line 1, in top-level template code
{% extends base_template %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\baselayout.html", line 2, in top-level template code
{% import 'appbuilder/baselib.html' as baselib %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\init.html", line 42, in top-level template code
{% block body %}
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\baselayout.html", line 19, in block 'body'
{% block content %}
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\general\model\list.html", line 13, in block 'content'
{% block list_list scoped %}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\templates\appbuilder\general\model\list.html", line 15, in block 'list_list'
{{ widgets.get('list')()|safe }}
^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask_appbuilder\widgets.py", line 33, in call
template = jinja_env.get_template(self.template)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 64, in get_source
return self._get_source_fast(environment, template)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\superset-dev\superset-60-env\Lib\site-packages\flask\templating.py", line 98, in _get_source_fast
raise TemplateNotFound(template)
jinja2.exceptions.TemplateNotFound: superset/fab_overrides/list.html
2025-11-17 15:25:22,094 INFO sqlalchemy.engine.Engine ROLLBACK
2025-11-17 15:25:22,094:INFO:sqlalchemy.engine.Engine:ROLLBACK
2025-11-17 15:25:22,121:INFO:werkzeug:127.0.0.1 - - [17/Nov/2025 15:25:22] "GET /permissions/list/ HTTP/1.1" 500 -

Checklist

I have searched Superset docs and Slack and didn't find a solution to my problem.
I have searched the GitHub issue tracker and didn't find a similar bug report.
I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

@YizhiDu

Hi @YizhiDu! I'm Dosu and I’m helping the superset team.

The error you're seeing (jinja2.exceptions.TemplateNotFound: superset/fab_overrides/list.html) happens because Superset's permission views expect a custom template that should be present in the codebase at superset/templates/superset/fab_overrides/list.html and referenced by the relevant widgets and views. This template was not removed or renamed in 6.0.0rc2, so the issue is likely with how templates are loaded or installed in your environment (source).

A recent thread confirms that similar errors and broken menu items in 6.0.0rc2 were caused by outdated template references and have been fixed in PR #36058. Make sure your environment includes all the latest templates and that your installation isn't missing the superset/templates/superset/fab_overrides/list.html file. If you installed Superset via pip or built from source, try a clean install or rebuild, and confirm your template paths are correct.

If you use a custom deployment (like a subpath or Docker), double-check that your template folders are mounted and accessible to Flask. If you have custom configuration flags for Flask AppBuilder security views, ensure they're enabled as needed:

FAB_ADD_SECURITY_PERMISSION_VIEW = True
FAB_ADD_SECURITY_VIEW_MENU_VIEW = True
FAB_ADD_SECURITY_PERMISSION_VIEWS_VIEW = True
FAB_ADD_SECURITY_ROLE_VIEW = True
FAB_ADD_SECURITY_USER_VIEW = True

Once the template is accessible, the error should be resolved and the permissions views should work as expected.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosu

I don't see in the 6.0 branch of superset fab_overrides/list. Htmlsuperset/templates/superset fab_overrides/list. The path to the HTML file, but it exists in the low version, You mentioned that there is no relevant description in the PR #36058 fix. I need to determine whether this is a defect in the pre-release branch and whether it will be fixed in the future official release. @dosu

The missing superset/templates/superset/fab_overrides/list.html file in the 6.0 branch is an intentional change, not a defect. The template and related references were removed as part of a broader cleanup and refactor in the 6.0 release (PR #36058, PR #36054). However, some code (like in superset/security/manager.py) still references the old template, which can cause the TemplateNotFound error you’re seeing if those views are enabled or accessed (source).

Maintainers have acknowledged this as part of the migration to new UI components and security models in 6.0, and fixes for broken references are being rolled out in the pre-release branch and will be included in the official release (issue #35027). If you need the legacy permissions views, make sure your deployment includes the correct templates and that your config flags for security views are set appropriately. Otherwise, expect these views to be replaced or refactored as part of the ongoing migration in 6.0.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

Yep, this was a real defect in 6.0.0rc2. The custom list template those FAB security views used (superset/fab_overrides/list.html) got deleted in a cleanup pass, but the widget classes were still pointing at it... so /permissions/list/, /permissionviews/list/, and /roles/list/ all 500'd with TemplateNotFound.

Good news is it's already fixed on master by #36058, which dropped those dangling widget references so the views fall back to FAB's default list template. That landed after rc2 was cut, so it'll be in the next 6.0 release rather than rc2 itself.

Closing as resolved, but happy to reopen if you still hit it on a build that includes #36058. Thanks for the detailed traceback, made this easy to track down!

test(security): regression coverage for #36130 FAB permission view te…

Navigation Menu

Repository navigation

6.0.0rc2-Security-Base Permissions and Permission on Views/Menus click "Internal server error" #36130

Bug description

Screenshots/recordings

Superset version

Python version

Node version

Browser

Additional context

Checklist

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

6.0.0rc2-Security-Base Permissions and Permission on Views/Menus click "Internal server error" #36130

Description

Bug description

Screenshots/recordings

Superset version

Python version

Node version

Browser

Additional context

Checklist

Activity

dosubot commented on Nov 17, 2025

YizhiDu commented on Nov 17, 2025

dosubot commented on Nov 17, 2025

rusackas commented on Jun 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions