CVE-2025-12405

HighCVSS 7.7/10Last modified Oct 7, 2026

Description

An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors.

A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database due to the stored credentials attached to the report.

This vulnerability was patched on 21 July 2025, and no customer action is needed.

Metrics

CVSS 4.0 7.7/10CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Nov 10, 2025
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-124066.1The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1CVE-2025-124074.3The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versionsCVE-2025-124085.3The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up toCVE-2025-124097.3A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating aCVE-2025-12414.9Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which aCVE-2025-124106.1The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This isCVE-2025-124117.1The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up toCVE-2025-124126.1The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This iCVE-2025-124135.4The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1CVE-2025-124149.2An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalizaCVE-2025-124156.1The MapMap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missinCVE-2025-124166.1The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, a
CVE-2025-12405: High severity, CVSS 7.7 | Vulnix