Security Issue With Tableau Row Level Access Controls

Description: Tableau allows for row-level access controls to be implemented to database fields via a filter feature that designates whether a particular value is included or excluded in a query. As a result of a broken access control, workbook fields with the filter compression feature enabled are exposed in data visualizations if new values are added to the fields after they were originally filtered.

CVSS Score: 4.3 (for a score breakdown, see here) 

Resolution: Tableau has disabled the filter compression feature by default in Tableau Cloud and Server for the November Maintenance release. 

Immediate Customer Actions: 

• • Open workbooks and manually inspect filter membership for all filter types (including data source filters) by editing the filter. This must be done via the Edit Filter dialog, and not by inspecting a Quick Filter.

    • If the filter membership is not as intended, modify the filter membership to be correct.

    • Click OK or Apply in the Edit Filter Dialog to accept any changes and remove compressed filter definitions.

    • If inspecting data source filters for published data sources, republish the data source after accepting changes in the above step.

• If you wish to use the filter compression feature you may re-enable it by taking the following steps: 

  • Tableau Server: Enable the following data source capabilities to re-enable the filter compression feature:

    • CAP_QUERY_USE_DOMAIN_RANGES_OPTIMIZATION

    • CAP_QUERY_USE_DOMAIN_EXCEPT_OPTIMIZATION

    • For guidance on how to take these steps, please see the Help article, Tableau Capability Customizations Reference, and/or open a case with the Tableau Technical Support team here.

• Customer Performance Mitigations: 

  • If you wish to exclude values with filters: Customers who have filters that were intended to exclude specific values may do so by following the below steps:

  • Within the filter configuration dialog, select the “exclude” checkbox located on the right-hand side of the filter dialog and select the values to exclude them from queries.

  • If you wish to filter with range compression: Customers who have filters that were intended to filter on a range of values may do so by following the below steps:

  • Create a calculated field with logic that includes or excludes a given range of values. e.g:

IF [Column] >= "a" AND [Column] <= "c" THEN TRUE ELSE FALSE END

• Conditions necessary for unauthorized access to data: In workbooks containing filters on categorical fields that have the filter compression feature enabled, if new values are added to a field after that field was originally filtered, internal users with access to that workbook and who conduct queries could potentially view data to which they were not intended to have access. 

• Steps customers can take to review for evidence of unauthorized access to workbook data: 

  • First, identify Tableau workbooks with filter compression. Tableau workbooks with filter compression will contain one or more categorical filters with the following characteristics:

    • The filter will be defined as an inclusive filter (i.e. the “exclude” checkbox is not checked)

    • At least half of the filter values are selected (the boxes next to at least half of the values are checked).

    • The selected values form one or more contiguous block(s) (the selected values are touching).

    • When editing the filter via the Edit Filter dialog, if there is an Apply button, it will be clickable before any changes are made.

  • Then, to confirm what values are currently exposed, review workbooks with filter compression applied.

  • Please note that users of cube data sources wishing to remove filter compression from their workbooks will have to edit the filter membership and resave their workbooks.

• Tableau Server and Desktop Impacted Versions:

  • 2024.3-2024.3.0

  • 2024.2-2024.2.3 (Server/Desktop)

  • 2023.3-2023.3.10 (Server/Desktop)

  • 2023.2-2023.2.13(Desktop)

  • 2023.1-2023.1.17 (Server/Desktop)

  • 2022.4-2022.4.18 (Desktop)

  • 2022.3-2022.3.21 (Server/Desktop)

• Fixed in Versions:

  • 2024.3.1

  • 2024.2.5

  • 2023.3.12

  • 2023.2.15

  • 2023.1.19

  • 2022.4.20

Known Issue 

Addressed issue impacting Tableau's row-level access controls.