Salesforce OmniStudio Improper Preservation of Permissions Vulnerability in FlexCards

A vulnerability allowing the bypass of field-level security controls for Salesforce objects has been identified in Salesforce OmniStudio (FlexCards) versions prior to Spring 2025. This issue arises from improper preservation of permissions, which can lead to unauthorized access to sensitive data or functionality.

Impact

Exploitation of this vulnerability allows for the bypass of field-level security controls, potentially leading to unauthorized access to sensitive data within Salesforce objects.

Remediation

Users should review the affected components (Flexcards and Data Mappers) and verify that individuals experiencing data access issues have the necessary field-level security and permissions. User profiles or permission sets may need to be updated to restore the expected data visibility.