What is the CVSS score of CVE-2025-43701?

CVE-2025-43701 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Salesforce are affected by CVE-2025-43701?

A permissions flaw in Salesforce OmniStudio FlexCards allows unauthorized exposure of Custom Settings data, potentially compromising sensitive configuration information and business logic.

How to fix or mitigate CVE-2025-43701?

Within 24 hours: Inventory all OmniStudio FlexCards implementations and identify which contain sensitive Custom Settings data; notify relevant business owners and legal/compliance teams. Within 7 days: Restrict FlexCards access to essential users only via role-based permissions and review recent access logs for unauthorized exposure. Within 30 days: Upgrade OmniStudio to version 254 or later as soon as patch availability is confirmed, or implement compensating controls if upgrade timeline extends beyond this period.

Salesforce CVE-2025-43701

EUVD-2025-17661 HIGH

Improper Preservation of Permissions (CWE-281)

2025-06-10 security@salesforce.com

Privilege Escalation Information Disclosure Salesforce

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17661

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 12:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data.

This impacts OmniStudio: before version 254.

AnalysisAI

CVE-2025-43701 is an Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards that allows unauthenticated network attackers to read Custom Settings data without authorization. Affecting OmniStudio versions before 254, this high-severity flaw (CVSS 7.5) enables direct exposure of sensitive configuration data through a low-complexity attack requiring no user interaction or privileges. While KEV status and active exploitation details are not available in provided data, the combination of high CVSS score, unauthenticated attack vector, and direct confidentiality impact indicates significant real-world risk to Salesforce deployments storing sensitive configuration in Custom Settings.

Technical ContextAI

OmniStudio is a Salesforce cloud platform component providing low-code design and configuration tools. FlexCards is a declarative UI component within OmniStudio that enables rapid development of responsive card-based interfaces. The vulnerability stems from CWE-281 (Improper Preservation of Permissions), a weakness where access controls fail to properly restrict operations on sensitive resources. In this case, the FlexCards component fails to enforce proper permission checks when accessing Custom Settings—a Salesforce configuration storage mechanism intended for organization-wide or profile-specific settings. The vulnerability likely exists in the FlexCards rendering or data retrieval logic, where permission validation is either absent or improperly implemented, allowing the component to expose Custom Settings data regardless of user access privileges. CPE designation would be cpe:2.7:a:salesforce:omnistudio:*:*:*:*:*:*:*:* with versions prior to 254 affected.

RemediationAI

Primary Patch: Upgrade OmniStudio to version 254 or later; priority: Critical; notes: Salesforce typically delivers updates through automatic sandbox refreshes and controlled production deployments. Check Salesforce release notes for version 254 availability in your org's release cycle. Workaround (Temporary): Restrict FlexCards component access via Salesforce permission sets and sharing rules until patch is available; priority: High; notes: Disable or limit access to FlexCards in production environments if they are used to display or interact with Custom Settings data. Review which users/profiles have access to affected FlexCards components. Detection & Monitoring: Audit Custom Settings access logs in Salesforce to identify unauthorized access patterns; priority: High; notes: Enable debug logging for Custom Settings queries. Monitor Setup Audit Trail for permission modifications related to OmniStudio. Review FlexCards component usage analytics. Configuration Hardening: Review Custom Settings contents and recategorize sensitive data outside Custom Settings if possible; priority: Medium; notes: Custom Settings should not store secrets, encryption keys, or highly sensitive PII. Migrate sensitive configs to encrypted custom fields or external secret management.