PT-2026-1839 · Palantir · Palantir Dossier+1

Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-62487

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Palantir Dossier and Slides apps (affected versions not specified)

Description Images uploaded through the Dossier front-end app were not consistently marked with the correct security levels. This issue stemmed from a change implemented in May 2025 intended to enable file sharing across different artifacts, such as dossiers and presentations. In deployments configured with CBAC (Configuration-Based Access Control), a security picker dialog appears, allowing users to set the appropriate security level for uploads, mitigating the issue. However, in deployments without CBAC, no security picker is displayed, resulting in a default security level of CUSTOM without specific markings or datasets selected. Consequently, file access is governed solely by the “Default authorization rules” defined in the Auth Chooser configuration, which typically grants access to the Everyone group.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-62487

Affected Products

Palantir Dossier

Palantir Slides

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-62487 · Security Note
• https://t.me/CVEtracker/41883 · Telegram Post
• https://palantir.safebase.us/?tcuUid=c91a1b4f-72e7-4959-9e2d-3a341e5c7a1f · Note
• https://twitter.com/CVEnew/status/2009741107706331176 · Twitter Post