CVE-2025-12405: Unauthorized access through stored credentials in Looker Studio

Published Nov 10, 2025

Updated

An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors.

A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database due to the stored credentials attached to the report.

This vulnerability was patched on 21 July 2025, and no customer action is needed.

Affected Software

1 affected component

Google Looker Studio

Event History

Nov 10, 2025

CVE Published

via MITRE·09:27 AM

Data Sourced

via MITRE·09:27 AM

DescriptionWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-12405?

CVE-2025-12405 is classified as a high severity vulnerability due to its impact on privilege management.

How do I fix CVE-2025-12405?

To fix CVE-2025-12405, update your Google Looker Studio to the latest version released by Google.

Who is affected by CVE-2025-12405?

CVE-2025-12405 affects all users of Google Looker Studio utilizing JDBC-based connectors.

What type of vulnerability is CVE-2025-12405?

CVE-2025-12405 is an improper privilege management vulnerability.

What can an attacker do with CVE-2025-12405?

An attacker exploiting CVE-2025-12405 could execute arbitrary SQL on the data source database through a report copy.