CVE-2025-15097

Alteryx Server status improper authentication

State: Published
Severity: 6.9 Medium
Published: Dec 26, 2025
Updated: Dec 26, 2025
Reserved: Dec 25, 2025

Description

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 and 2025.1.1.1.31 can resolve this issue. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
ServerAlteryx	2020.2.3.27789Affected 2021.4.2.47895Affected 2022.1.1.30961Affected 2022.1.1.42707Affected 2023.1.1.123Affected 2023.1.1.306Affected 2023.2.1.51Affected 2024.1.1.49Affected 2024.1.1.136Affected 2024.1.1.209Affected 2024.2.1.14Affected 2024.2.1.41Affected 2024.2.1.73Affected 2024.2.1.94Affected 2023.1.1.13.486Not affected 2023.2.1.10.293Not affected 2024.1.1.9.236Not affected 2024.2.1.6.125Not affected 2025.1.1.1.31Not affected

Product

Versions

ServerAlteryx

2020.2.3.27789Affected
2021.4.2.47895Affected
2022.1.1.30961Affected
2022.1.1.42707Affected
2023.1.1.123Affected
2023.1.1.306Affected
2023.2.1.51Affected
2024.1.1.49Affected
2024.1.1.136Affected
2024.1.1.209Affected
2024.2.1.14Affected
2024.2.1.41Affected
2024.2.1.73Affected
2024.2.1.94Affected
2023.1.1.13.486Not affected
2023.2.1.10.293Not affected
2024.1.1.9.236Not affected
2024.2.1.6.125Not affected
2025.1.1.1.31Not affected

References

VDB-338428 | Alteryx Server status improper authenticationvdb-entry
VDB-338428 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #710169 | Alteryx Alteryx Server 2020/2021/2022/2023/2024/2025 Authentication Bypass Issuesthird-party-advisory
https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdfrelated
https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08cexploit
https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.htmlpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.