Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Tableau Server on Windows and Linux: Unauthorized Access to Data

CVE-2025-52447 · published 1 year ago
Summary

A flaw in Tableau Server on Windows and Linux allows an attacker to access data they shouldn't have. This happens when a user is tricked into giving the attacker a special key. Affected versions of Tableau Server need to be updated to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tableau tableau_server < 2023.3.19
>= 2024.2, < 2024.2.12
>= 2025.1, < 2025.1.3
cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*
Original advisory text
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to ...
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published25 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-52447 · NVD
Track software like this
Free during beta