Researcher Finds Five Zero-Days and 20+ Misconfigurations in Salesforce Cloud

AppOmni disclosed five security issues in Salesforce OmniStudio (FlexCards, Data Mappers, OmniScript saved sessions, etc.), including two zero-day improper-permission vulnerabilities that can expose encrypted fields, custom settings, credentials and session data; Salesforce has patched three CVEs and provided customer-configurable mitigations for the remaining two, while warning that misconfiguration could lead to large-scale data exposure and regulatory liability.