PT-2025-53435 · Alteryx · Alteryx Server

Diyan Apostolov + 1 · CVE-2025-15097 · Published 2025-12-26 · Updated 2025-12-31

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Alteryx Server versions prior to 2023.1.1.13.486 Alteryx Server versions prior to 2023.2.1.10.293 Alteryx Server versions prior to 2024.1.1.9.236 Alteryx Server versions prior to 2024.2.1.6.125 Alteryx Server versions prior to 2025.1.1.1.31

Description A flaw exists in Alteryx Server related to improper authentication. This issue is associated with an unknown functionality within the /gallery/api/status/ file. Remote manipulation of this functionality can lead to authentication bypass. The exploit for this issue has been publicly disclosed.

Recommendations Upgrade to version 2023.1.1.13.486. Upgrade to version 2023.2.1.10.293. Upgrade to version 2024.1.1.9.236. Upgrade to version 2024.2.1.6.125. Upgrade to version 2025.1.1.1.31.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-15097

Affected Products

Alteryx Server

References · 11

• 🔥 https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08c · Exploit
• https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-15097 · Security Note
• https://t.me/cveNotify/146848 · Telegram Post
• https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdf · Note
• https://vuldb.com/?id.338428 · Note
• https://twitter.com/cracbot/status/2006319465345273860 · Twitter Post
• https://t.me/CVEtracker/40685 · Telegram Post
• https://twitter.com/CVEnew/status/2004457734306247117 · Twitter Post
• https://vuldb.com/?ctiid.338428 · Note
• https://vuldb.com/?submit.710169 · Note