What is the CVSS score of EUVD-2025-17657?

EUVD-2025-17657 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Salesforce are affected by EUVD-2025-17657?

A permissions vulnerability in Salesforce OmniStudio FlexCards could allow unauthorized users to access encrypted data within your Salesforce environment.

How to fix or mitigate EUVD-2025-17657?

Within 24 hours: Inventory all OmniStudio FlexCards deployments and identify those containing sensitive encrypted data. Within 7 days: Implement access controls to restrict FlexCards usage to authenticated users with documented business need; review audit logs for unauthorized access attempts. Within 30 days: Plan and execute upgrade to Spring 2025 or later; validate permissions enforcement post-deployment.

Salesforce EUVD-2025-17657

| CVE-2025-43700 HIGH

Improper Preservation of Permissions (CWE-281)

2025-06-10 security@salesforce.com

Privilege Escalation Information Disclosure Salesforce

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17657

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 12:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.

This impacts OmniStudio: before Spring 2025.

AnalysisAI

CVE-2025-43700 is an Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards that allows unauthenticated network-based attackers to expose encrypted data without requiring user interaction. This high-impact confidentiality breach (CVSS 7.5) affects OmniStudio versions prior to Spring 2025 release and represents a significant risk to organizations using FlexCards for sensitive data handling, particularly given the low attack complexity and absence of privilege requirements.

Technical ContextAI

The vulnerability stems from CWE-281 (Improper Preservation of Permissions), a weakness class where access controls fail to be properly maintained during data transformation or transit. In the context of OmniStudio FlexCards, this manifests as encrypted data exposure—likely occurring during the rendering or processing of FlexCard components when permission checks are bypassed or inadvertently stripped. FlexCards are Salesforce OmniStudio components used for dynamic UI rendering and data presentation. The root cause appears to involve the FlexCards engine failing to enforce or preserve security contexts when handling encrypted sensitive information, potentially during API calls, component initialization, or data serialization phases. The AV:N (Network) vector indicates the flaw is exploitable remotely without physical access, and AC:L (Low Complexity) suggests no special conditions are required beyond crafting a standard HTTP request to trigger the exposure.

RemediationAI

Immediate actions: (1) Upgrade OmniStudio to Spring 2025 release or later immediately—this is the primary remedial patch; (2) If immediate upgrade is not feasible, review Salesforce Security Advisory for CVE-2025-43700 for interim guidance and workarounds; (3) Audit FlexCard component usage in your Salesforce org and identify which FlexCards process or display encrypted sensitive data; (4) Implement temporary mitigations such as restricting FlexCard API access via Salesforce IP whitelisting, disabling unnecessary FlexCard components until patching, or applying Lightning record page security policies to limit exposure; (5) Monitor Salesforce trust status and apply the Spring 2025 patch during your next scheduled maintenance window if immediate patching is not possible; (6) Review access logs for any unauthorized access to encrypted data via FlexCard APIs in the period prior to patching. Contact Salesforce Support for advisory links and patch validation procedures specific to your deployment.