CVE-2025-63291 describes an improper authorization vulnerability in Alteryx Server versions 2022.1.1.42654 and 2024.1. The server failed to validate user permissions when processing API requests that utilized MongoDB object IDs, allowing authenticated users to access other users' records, including sensitive administrative and private studio API keys. This medium-severity vulnerability has a CVSS score of 5.4, indicating a network-attackable flaw with low attack complexity and requiring low privileges, potentially leading to low confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2022.1.0, <= 2022.1.1.42654CPE matchmatch criteria | cpe:2.3:a:alteryx:alteryx_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.