Introduction
Unauthorized access to a production database cluster can expose large amounts of data and create regulatory risk. CVE-2025-52446 is a high-severity vulnerability in Salesforce Tableau Server that lets attackers bypass authorization controls through user-controlled keys. Organizations that rely on Tableau for analytics face a direct risk to their data.
About Tableau Server and Salesforce: Tableau Server is an enterprise analytics and data visualization platform that many organizations use for business intelligence and reporting. Salesforce acquired Tableau, which has thousands of enterprise customers and is a core part of many organizations' data environments. Salesforce has a broad footprint across the global technology industry and a reputation for responding quickly to security issues.
Technical information
CVE-2025-52446 is an authorization bypass in the tab-doc API modules of Tableau Server. The cause is insufficient validation of user-controlled keys. By manipulating these keys or their associated parameters, an attacker can change how the interface behaves and get past the intended authorization checks. The result can be unauthorized access to sensitive data in the production database cluster.
The flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The affected modules do not properly enforce access controls when they process user-supplied input, so an attacker can craft requests that grant privileges or data access beyond their intended scope. No public code snippets or proof-of-concept details are available for this vulnerability.
Affected systems and versions
- Tableau Server on Windows and Linux
- Affected versions:
- All versions before 2025.1.3
- All versions before 2024.2.12
- All versions before 2023.3.19
- Vulnerable component: tab-doc API modules
Vendor security history
Salesforce, Tableau's parent company, has a track record of addressing security issues promptly. For critical vulnerabilities it typically releases patches and advisories quickly and gives customers detailed remediation guidance. Previous vulnerabilities in Tableau Server include:
- CVE-2025-26494: SSRF-enabled authentication bypass
- CVE-2025-43698: Field-level security bypass
