CVE-2025-52446 in Tableau Server
Summary
by MITRE • 07/25/2025
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/13/2026
This vulnerability represents a critical authorization bypass flaw that exploits user-controlled input to manipulate interface components within Salesforce Tableau Server across both Windows and Linux platforms. The issue specifically targets the tab-doc api modules where an attacker can manipulate interface elements to gain unauthorized access to production database clusters. The vulnerability stems from insufficient validation of user-supplied keys that control access permissions, allowing malicious actors to bypass normal authorization mechanisms through carefully crafted interface manipulation techniques. This represents a sophisticated attack vector that leverages the trust model inherent in the application's interface handling to escalate privileges and access sensitive data.
The technical implementation of this vulnerability involves exploiting the way Tableau Server processes user-controlled keys within the tab-doc api modules to manipulate the application's authorization flow. When users provide input that controls interface elements, the system fails to properly validate or sanitize these inputs before using them to determine access rights. This allows attackers to craft malicious requests that manipulate the application's internal state, effectively bypassing the normal authorization checks that should prevent unauthorized database access. The vulnerability specifically affects the interface manipulation capabilities that control data access permissions, enabling attackers to traverse the application's security boundaries and gain direct access to production database clusters.
The operational impact of this vulnerability extends beyond simple unauthorized data access, as it represents a complete breakdown in the application's security model that could lead to significant data breaches and system compromise. Attackers with access to the affected Tableau Server installations can potentially extract sensitive information, modify database contents, or establish persistent access to production environments. The vulnerability affects multiple version streams including 2025.1.3, 2024.2.12, and 2023.3.19, indicating this is a widespread issue that impacts organizations running various versions of the platform. The risk is particularly severe because Tableau Server is commonly used for business intelligence and data analysis, making the exposed database clusters likely to contain sensitive corporate information.
Organizations should immediately implement mitigations including updating to the patched versions mentioned in the advisory, implementing additional input validation controls, and monitoring for suspicious interface manipulation patterns. Security teams should also consider implementing network segmentation to limit access to database clusters and deploy additional monitoring controls to detect unauthorized access attempts. The vulnerability aligns with CWE-285 which addresses improper authorization issues, and may be categorized under ATT&CK technique T1078 for valid accounts and T1566 for spearphishing with a specific focus on interface manipulation. Organizations should also review their access control policies and implement principle of least privilege controls to minimize the impact of potential exploitation.
This vulnerability demonstrates the critical importance of input validation in security-critical applications and highlights the risks associated with allowing user-controlled data to influence authorization decisions. The flaw represents a classic case of insufficient security controls in application interfaces where user inputs are not properly sanitized before being used to make access control decisions. Organizations should conduct comprehensive security assessments of their Tableau Server deployments, review access control configurations, and implement additional security layers including database activity monitoring and access logging to detect potential exploitation attempts. The vulnerability serves as a reminder that even seemingly benign interface manipulation capabilities can represent significant security risks when not properly secured against malicious input.