Read the docs
TI-2025-38731 Aliases CVE-2025-62487GHSA-4wq3-r6vg-34q5

Incorrect authorization in Palantir com.palantir.acme:gotham-default-apps-bundle

Priority LOW 16CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations). On deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue. On deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the default authorization rules defined in the Auth Chooser configuration. On most environments, it is expected that the default authorization rules only add the Everyone group.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00223 12th percentileScored 2026-11-07
Fix Fixed com.palantir.acme:gotham-default-apps-bundle (Palantir): 100.30251002.0, 100.30250808.87, 100.30250908.1 +5com.palantir.acme:stencil-app-bundle (Palantir): 100.30250907.11, 100.30250507.88, 100.30250908.1 +5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Palantircom.palantir.acme:gotham-default-apps-bundle100.30250502.0 to before 100.30251002.0100.30251002.0, 100.30250808.87, 100.30250908.1, 100.30250709.54, 100.30250907.11, 100.30250507.88, 100.30251001.1, 100.30250906.52Patch availableCNA
Palantircom.palantir.acme:stencil-app-bundle100.30250502.0 to before 100.30251002.0100.30250907.11, 100.30250507.88, 100.30250908.1, 100.30250808.87, 100.30251002.0, 100.30251001.1, 100.30250906.52, 100.30250709.54Patch availableCNA
Palantircom.palantir.acme:dossier-app100.30250502.0 to before 100.30251002.0100.30250907.11, 100.30251002.0, 100.30251001.1, 100.30250808.87, 100.30250908.1, 100.30250709.54, 100.30250507.88, 100.30250906.52Patch availableCNA
  • com.palantir.acme:gotham-default-apps-bundle VendorPalantir Affected 100.30250502.0 to before 100.30251002.0 Fixed in 100.30251002.0, 100.30250808.87, 100.30250908.1, 100.30250709.54, 100.30250907.11, 100.30250507.88, 100.30251001.1, 100.30250906.52 Patch available CNA
  • com.palantir.acme:stencil-app-bundle VendorPalantir Affected 100.30250502.0 to before 100.30251002.0 Fixed in 100.30250907.11, 100.30250507.88, 100.30250908.1, 100.30250808.87, 100.30251002.0, 100.30251001.1, 100.30250906.52, 100.30250709.54 Patch available CNA
  • com.palantir.acme:dossier-app VendorPalantir Affected 100.30250502.0 to before 100.30251002.0 Fixed in 100.30250907.11, 100.30251002.0, 100.30251001.1, 100.30250808.87, 100.30250908.1, 100.30250709.54, 100.30250507.88, 100.30250906.52 Patch available CNA

Remediation

  • Fix · CNA com.palantir.acme:gotham-default-apps-bundle (Palantir) Fixed in 100.30251002.0, 100.30250808.87, 100.30250908.1, 100.30250709.54, 100.30250907.11, 100.30250507.88, 100.30251001.1, 100.30250906.52
  • Fix · CNA com.palantir.acme:stencil-app-bundle (Palantir) Fixed in 100.30250907.11, 100.30250507.88, 100.30250908.1, 100.30250808.87, 100.30251002.0, 100.30251001.1, 100.30250906.52, 100.30250709.54
  • Fix · CNA com.palantir.acme:dossier-app (Palantir) Fixed in 100.30250907.11, 100.30251002.0, 100.30251001.1, 100.30250808.87, 100.30250908.1, 100.30250709.54, 100.30250507.88, 100.30250906.52

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62487
  2. 2026-10-03 Alias added: GHSA-4wq3-r6vg-34q5

References

Other 1

  • TI-2023-14703 Path traversal in Palantir com.palantir.gotham:clips2 CVSS 3.1CRITICAL 9.8
  • TI-2023-14719 Gotham Orbital Simulator path traversal CVSS 3.1CRITICAL 9.8
  • TI-2024-33078 Glutton V1 endpoints missing authentication CVSS 3.1CRITICAL 9.1
  • TI-2023-14721 Palantir Tiles missing authentication on API endpoints CVSS 3.1HIGH 8.2
  • TI-2022-10769 Uncontrolled resource consumption in Palantir Foundry Multipass CVSS 3.1CRITICAL 9.1
  • TI-2022-10777 Palantir Gotham included an endpoint that would log arbitrary sized zip files. CVSS 3.1HIGH 7.5
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences