Public dashboards become inaccessible when assigned a theme (6.0.0)

[sfirke]

Bug description

1. Create a dashboard, enable DASHBOARD_RBAC, assign the role "Public" to the dashboard, verify that works
2. Create a theme and assign it to the dashboard
3. Dashboard now redirects unauthenticated users to login
4. If the theme is unassigned to the dashboard, the dashboard again becomes public

Fix: add the permission can read Theme to the Public role.

Screenshots/recordings

No response

Superset version

6.0.0

Python version

I don't know

Node version

I don't know

Browser

Firefox

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

This happens because when you assign a theme to a dashboard in Superset 6.0.0 with DASHBOARD_RBAC enabled, the system checks if the viewing user (including unauthenticated/public users) has the can read Theme permission. If the Public role doesn't have this permission, unauthenticated users are redirected to the login page instead of seeing the dashboard. Removing the theme or granting can read Theme to the Public role restores public access.

This is consistent with how Superset handles permissions for related objects—missing read/list/show permissions on things like datasets, charts, or themes can block access for readonly or public roles and trigger login redirects. The built-in Public role is intended to have only minimal, safe permissions, and can read Theme is not always included by default, especially for custom or database-stored themes. There isn't official documentation listing this permission as required for public dashboards, but community reports confirm that adding it resolves the issue when themes are assigned.

To fix this, add the can read Theme permission to the Public role. Be aware that permissions for the Public role may be reset on upgrades or restarts, so you may need to reapply this change if you update Superset in the future. For more details on the Public role and permission model, see the built-in Public role PR.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[sfirke]

Great, adding that permission to the public role worked! Thanks @dosu.

I want to build on the PR you linked and add this permission to the set defined in PUBLIC_ROLE_PERMISSIONS in the file https://github.com/apache/superset/blob/master/superset/security/manager.py. Would I add it as ("can_read", "Theme") ? And I'm curious, can you explain how Gamma role currently gets this permission?

[dosubot]

Yes, adding ("can_read", "Theme") to PUBLIC_ROLE_PERMISSIONS in superset/security/manager.py is the correct way to grant this permission by default—it matches the tuple format used for other permissions in that set. This ensures the Public role can access dashboards with assigned themes without triggering a login redirect, and is consistent with the approach used in the built-in Public role PR and recent code changes (source).

For the Gamma role: permissions aren't defined by a static list. Instead, Gamma gets its permissions dynamically during role sync. The SupersetSecurityManager uses the _is_gamma_pvm method to filter all available permissions, granting Gamma any permission that isn't user-defined, admin-only, alpha-only, or SQL Lab-only, or is accessible to all users. As long as "can_read" on "Theme" isn't restricted by those categories, Gamma receives it by default (source).

The Public role is intentionally more restrictive and only gets permissions explicitly listed in PUBLIC_ROLE_PERMISSIONS, while Gamma gets a broader set via this dynamic logic. Just a heads up: Public role permissions are synced on startup and may be overwritten during upgrades, so any manual changes should be tracked for future updates (source).

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}