CVE-2025-12405
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An improper privilege management vulnerability in Looker Studio affects all JDBC-based connectors. A user with report view access could copy the report and execute arbitrary SQL on the data source database using stored credentials. This was patched on 21 July 2025, no customer action is needed.
Risk Assessment
The risk includes unauthorized access to source data and the ability to execute arbitrary SQL queries, potentially leading to data confidentiality and integrity breaches. An attacker with report access could gain full control over the data.
Recommendation
No customer action is needed as the patch has already been deployed. However, it is recommended to verify if any unauthorized access to reports and data has occurred.
Other vulnerabilities in Looker Studio
See all- CVE-2025-12409High
A SQL injection vulnerability in Looker Studio allowed data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled and having the victim access it, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This was patched on 07 July 2025, no customer action is needed.
- CVE-2025-12397High
A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected reports with BigQuery as the data source. This vulnerability was patched on 21 July 2025, and no customer action is needed.
Original NVD description (English source)
An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database due to the stored credentials attached to the report. This vulnerability was patched on 21 July 2025, and no customer action is needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS