CVE-2025-43699 Overview
CVE-2025-43699 is a Client-Side Enforcement of Server-Side Security vulnerability [CWE-602] in Salesforce OmniStudio FlexCards. The flaw allows an attacker to bypass a required permission check because authorization logic executes on the client rather than the server. Attackers can request protected functionality directly and retrieve data that permission checks should have blocked. The issue affects OmniStudio releases prior to Spring 2025.
Critical Impact
Unauthenticated network-based attackers can bypass permission checks in OmniStudio FlexCards and access information that should require server-side authorization.
Affected Products
- Salesforce OmniStudio (FlexCards) versions before Spring 2025
- Salesforce OmniStudio deployments relying on FlexCards for permission-gated content
- Salesforce orgs that expose FlexCards to unauthenticated or lower-privilege users
Discovery Timeline
- 2025-06-10 - CVE-2025-43699 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43699
Vulnerability Analysis
Salesforce OmniStudio FlexCards render dynamic data and actions in the Salesforce UI. The FlexCards framework enforced a required permission check on the client, exposing the associated server-side capability without an equivalent server-enforced authorization gate. An attacker who understands the client protocol can call the underlying service directly and skip the check that the browser would normally perform. The result is unauthorized read access to information governed by the bypassed permission.
The issue maps to [CWE-602: Client-Side Enforcement of Server-Side Security]. Trusting the client to enforce authorization is a recurring design flaw in low-code and page-composition frameworks, where UI components mediate access to backend data. The EPSS score of 0.374% reflects a low modeled probability of near-term exploitation, but the flaw remains attractive for reconnaissance in Salesforce environments.
Root Cause
The FlexCards component enforced permission logic in the client-side rendering path instead of validating the caller's entitlements on the server. When a request bypasses the client control, the backend does not re-validate the permission before returning data.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker issues crafted requests to FlexCard endpoints, omitting or manipulating the client-side checks. Confidentiality is impacted; integrity and availability are not affected. No public exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified public proof-of-concept code exists for CVE-2025-43699. Refer to the Salesforce Help Article for vendor-supplied technical detail.
Detection Methods for CVE-2025-43699
Indicators of Compromise
- Unexpected FlexCard data-source requests originating from sessions that lack the associated user permission set.
- Elevated volume of direct API calls to OmniStudio FlexCard endpoints without corresponding page-render telemetry.
- Access log entries showing successful data retrieval from FlexCards by profiles that should be denied.
Detection Strategies
- Compare Salesforce Event Monitoring logs for FlexCard invocations against the profile and permission set of the invoking user.
- Alert on anomalous OmniStudio data-provider queries returning fields tied to permissions the user does not hold.
- Baseline normal FlexCard usage per role, then flag deviations that indicate direct endpoint access.
Monitoring Recommendations
- Enable Salesforce Shield Event Monitoring for API and Lightning component activity involving OmniStudio.
- Forward Salesforce audit and event logs to a central SIEM for correlation with identity and network telemetry.
- Review OmniStudio FlexCard configurations for components exposed to Guest User or low-privilege profiles.
How to Mitigate CVE-2025-43699
Immediate Actions Required
- Upgrade Salesforce OmniStudio to the Spring 2025 release or later, which addresses the FlexCards permission enforcement.
- Inventory all FlexCards in production orgs and confirm each references data protected by server-enforced permissions.
- Restrict Guest User and community profile access to OmniStudio FlexCards until the fix is applied.
Patch Information
Salesforce addressed the issue in OmniStudio Spring 2025. Consult the Salesforce Help Article for release details and upgrade guidance. Salesforce typically updates managed packages and org releases on Salesforce-managed schedules; administrators should verify the org version and package version.
Workarounds
- Remove or hide FlexCards that expose permission-gated data from profiles that do not require them.
- Add server-side permission checks in Apex controllers or data mappers invoked by FlexCards where feasible.
- Restrict network exposure of OmniStudio-facing Experience Cloud sites while a permanent fix is rolled out.
# Example: query FlexCard usage via Salesforce CLI for audit
sf data query --query "SELECT Id, Name, Type, LastModifiedDate FROM OmniUiCard WHERE Type = 'FlexCard'" --target-org prod
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
