CVE-2025-52446: Tableau Server Auth Bypass Vulnerability

CVE-2025-52446 Overview

An Authorization Bypass Through User-Controlled Key vulnerability has been identified in Salesforce Tableau Server affecting both Windows and Linux platforms. The vulnerability exists within the tab-doc API modules and allows attackers to perform Interface Manipulation, potentially gaining unauthorized data access to the production database cluster.

This flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when an application uses user-supplied input as a key to retrieve authorization information, allowing malicious actors to manipulate these keys to bypass access controls.

Critical Impact

Successful exploitation could allow an attacker on an adjacent network to bypass authorization controls and gain unauthorized access to sensitive data within the production database cluster, potentially compromising confidentiality, integrity, and availability of critical business intelligence data.

Affected Products

• Tableau Server versions before 2025.1.3
• Tableau Server versions before 2024.2.12
• Tableau Server versions before 2023.3.19

Discovery Timeline

• July 25, 2025 - CVE-2025-52446 published to NVD
• October 31, 2025 - Last updated in NVD database

Technical Details for CVE-2025-52446

Vulnerability Analysis

This vulnerability resides in Tableau Server's tab-doc API modules, which handle document and data access operations. The authorization bypass occurs because the application relies on user-controlled key values to determine access permissions to resources. When an attacker can manipulate these key parameters, they can potentially access data belonging to other users or gain elevated privileges within the system.

The vulnerability requires adjacent network access and user interaction to exploit, indicating that an attacker must be positioned on the same network segment as the target Tableau Server and requires some form of user action to trigger the exploitation. Despite these requirements, the potential impact is severe as successful exploitation could compromise the confidentiality, integrity, and availability of data stored in the production database cluster.

Root Cause

The root cause of this vulnerability is improper implementation of authorization checks within the tab-doc API modules. The application uses user-supplied keys or identifiers to retrieve or modify data without adequately verifying that the requesting user has legitimate authorization to access the referenced resources. This represents a classic Insecure Direct Object Reference (IDOR) pattern where object references are exposed to users without proper access control validation.

Attack Vector

The attack vector for CVE-2025-52446 requires adjacent network positioning, meaning the attacker must have access to the same local network as the vulnerable Tableau Server instance. The attack involves manipulating API requests to the tab-doc modules by modifying key parameters that reference data objects or user accounts.

An attacker could craft malicious requests that substitute their own user identifiers with those of other users or administrative accounts, effectively bypassing the authorization layer. Since user interaction is required, social engineering or phishing techniques may be employed to trigger the vulnerable code path with the victim's session context.

The exploitation allows interface manipulation, enabling attackers to interact with the production database cluster in unauthorized ways, potentially reading sensitive business intelligence data, modifying visualizations, or disrupting data availability.

Detection Methods for CVE-2025-52446

Indicators of Compromise

• Unusual API requests to tab-doc endpoints with parameter manipulation patterns
• Access logs showing data retrieval for resources not typically accessed by the requesting user account
• Anomalous cross-user data access patterns in Tableau Server audit logs
• Unexpected queries to the production database cluster from Tableau Server processes

Detection Strategies

• Implement API request monitoring to identify parameter tampering attempts on tab-doc endpoints
• Enable detailed audit logging for all data access operations within Tableau Server
• Deploy network-based intrusion detection rules to identify authorization bypass attempt patterns
• Monitor for unusual session behavior where single users access resources across multiple authorization contexts

Monitoring Recommendations

• Configure alerting for failed authorization attempts followed by successful access using different parameters
• Establish baselines for normal user data access patterns to detect anomalous behavior
• Review Tableau Server logs regularly for signs of enumeration attacks against user identifiers
• Implement real-time monitoring of database cluster access patterns originating from Tableau Server

How to Mitigate CVE-2025-52446

Immediate Actions Required

• Upgrade Tableau Server to version 2025.1.3 or later immediately
• For Tableau Server 2024.x deployments, upgrade to version 2024.2.12 or later
• For Tableau Server 2023.x deployments, upgrade to version 2023.3.19 or later
• Restrict network access to Tableau Server to only authorized network segments while patching is performed

Patch Information

Salesforce has released security patches addressing this vulnerability in Tableau Server versions 2025.1.3, 2024.2.12, and 2023.3.19. Organizations should apply the appropriate patch based on their current deployment version. For detailed patch information and download links, refer to the Salesforce Help Article.

Workarounds

• Implement network segmentation to restrict adjacent network access to Tableau Server instances
• Deploy web application firewall (WAF) rules to detect and block parameter manipulation attempts
• Enable enhanced audit logging and actively monitor for suspicious access patterns until patches can be applied
• Consider temporarily restricting access to sensitive workbooks and data sources for high-risk environments

# Example: Restrict network access to Tableau Server (Linux iptables)
# Allow only specific trusted subnets to access Tableau Server
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP