Executive brief
Alteryx Server, a platform used for data analytics and workflow automation, contains a security flaw in how it handles API requests. An authenticated user could potentially access sensitive data belonging to other users, such as administrative API keys and private studio keys, by guessing or obtaining specific internal database identifiers. This could lead to unauthorized access to the server's administrative functions and private data environments.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Alteryx Server versions 2022.1.1.42654 and 2024.1. The application uses MongoDB object IDs to identify data requested via its API but fails to perform adequate authorization checks to ensure the requesting user has permission to access the specified object. An authenticated attacker can exploit this by supplying specific MongoDB object IDs in API calls to bypass authorization. Successful exploitation allows the retrieval of sensitive information, including administrative API keys and private studio API keys, which could facilitate further compromise of the Alteryx environment.
Affected products
- Alteryx Alteryx Server 2022.1.1.42654, 2024.1
Timeline
- 2025-11-14: advisory: Initial disclosure of CVE-2025-63291