CVE-2025-52447: Tableau Server Auth Bypass Vulnerability

CVE-2025-52447 Overview

CVE-2025-52447 is an Authorization Bypass Through User-Controlled Key vulnerability affecting Salesforce Tableau Server on Windows and Linux platforms. The vulnerability exists within the set-initial-sql tabdoc command modules and enables attackers to perform Interface Manipulation, potentially gaining unauthorized data access to production database clusters.

This vulnerability allows authenticated users to bypass authorization controls by manipulating user-controlled key parameters, leading to unauthorized access to sensitive data within the Tableau Server environment.

Critical Impact

Authenticated attackers can bypass authorization controls to access production database clusters, potentially exposing sensitive business intelligence data and analytics information.

Affected Products

• Tableau Server versions before 2025.1.3
• Tableau Server versions before 2024.2.12
• Tableau Server versions before 2023.3.19

Discovery Timeline

• July 25, 2025 - CVE-2025-52447 published to NVD
• October 31, 2025 - Last updated in NVD database

Technical Details for CVE-2025-52447

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), also known as Insecure Direct Object Reference (IDOR). The flaw resides in the set-initial-sql tabdoc command modules within Tableau Server, where insufficient validation of user-supplied parameters allows attackers to manipulate authorization decisions.

The vulnerability affects Tableau Server deployments on both Windows and Linux operating systems. When exploited, an authenticated attacker with low-level privileges can bypass authorization mechanisms to access data they should not have permission to view or modify. This could result in unauthorized access to sensitive business intelligence data, analytics dashboards, and underlying database connections configured within the Tableau environment.

Root Cause

The root cause stems from improper validation of user-controlled keys within the set-initial-sql tabdoc command modules. The application fails to adequately verify that the user making a request is authorized to access the specific resource identified by the user-supplied key. This allows attackers to reference resources belonging to other users or higher privilege levels by manipulating the key values in their requests.

Attack Vector

The attack is network-based and requires the attacker to have low-level authenticated access to the Tableau Server environment. Once authenticated, an attacker can craft malicious requests targeting the vulnerable set-initial-sql functionality within the tabdoc command modules.

The exploitation flow involves:

1. An authenticated attacker identifies endpoints or functionality that accept user-controlled keys for resource access
2. The attacker enumerates or guesses valid key values corresponding to resources they should not have access to
3. By substituting their authorized key with another user's or system's key, the attacker can bypass authorization checks
4. This enables unauthorized access to production database cluster connections and associated data

The vulnerability impacts both confidentiality and integrity of data, as attackers may be able to read sensitive information and potentially modify data within accessible database clusters.

Detection Methods for CVE-2025-52447

Indicators of Compromise

• Unusual access patterns to the set-initial-sql tabdoc command modules from low-privilege user accounts
• Log entries showing access to database resources or connections that don't match user authorization levels
• Abnormal query patterns or data access from Tableau Server to production database clusters
• Authentication events followed by access to resources outside the user's normal scope

Detection Strategies

• Monitor Tableau Server audit logs for access attempts to resources using modified or enumerated key values
• Implement anomaly detection for users accessing data sources or database connections outside their normal patterns
• Review access control logs for discrepancies between user permissions and accessed resources
• Deploy application-level monitoring to detect manipulation of tabdoc command parameters

Monitoring Recommendations

• Enable comprehensive audit logging for all Tableau Server tabdoc command operations
• Configure alerts for access to production database clusters from unexpected user contexts
• Implement real-time monitoring of the set-initial-sql functionality for suspicious parameter values
• Regularly review Tableau Server access logs for authorization bypass patterns

How to Mitigate CVE-2025-52447

Immediate Actions Required

• Upgrade Tableau Server to version 2025.1.3 or later for the 2025.x branch
• Upgrade Tableau Server to version 2024.2.12 or later for the 2024.2.x branch
• Upgrade Tableau Server to version 2023.3.19 or later for the 2023.3.x branch
• Review and audit existing database cluster access permissions within Tableau Server
• Enable enhanced logging to detect potential exploitation attempts

Patch Information

Salesforce has released security patches addressing this vulnerability in the following Tableau Server versions:

• Version 2025.1.3 and later
• Version 2024.2.12 and later
• Version 2023.3.19 and later

Organizations should apply the appropriate patch based on their current Tableau Server version branch. For detailed patching instructions and additional information, refer to the Salesforce Help Article.

Workarounds

• Implement network segmentation to limit access to Tableau Server from trusted networks only
• Apply principle of least privilege for all Tableau Server user accounts
• Restrict access to tabdoc command functionality to only essential administrative users
• Deploy web application firewall rules to monitor and block suspicious parameter manipulation attempts
• Conduct regular access reviews to ensure user permissions align with business requirements

Organizations should prioritize patching as the primary remediation method, as workarounds may not fully address the vulnerability.