Improper Permissions in Salesforce OmniStudio Exposes Encrypted Data
CVE-2025-43697

Currently unrated

Key Information:

Vendor

Salesforce

Status
Omnistudio
Vendor
CVE Published:
10 June 2025

What is CVE-2025-43697?

An improper preservation of permissions vulnerability in Salesforce OmniStudio (DataMapper) can lead to unintended exposure of encrypted data. This issue affects all versions of OmniStudio prior to Spring 2025, posing risks to data confidentiality and integrity. Organizations using this platform should assess their implementations and apply necessary mitigations to protect sensitive information.

Affected Version(s)

OmniStudio 0

References

https://help.salesforce.com/s/articleView?id=004980323&ty...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-43697 : Improper Permissions in Salesforce OmniStudio Exposes Encrypted Data