When a BI embed token reads the data behind the dashboard

A dashboard hides far more data than it shows. When the personal access token that powers a BI embed leaks, an attacker can reach the raw datasets behind the visuals, not just the rendered charts.

How the attack works

A BI embed integration, the kind that serves Tableau or Power BI dashboards into a customer portal, authenticates with a personal access token tied to a service identity. That token leaks from the embedding application’s config. The attacker replays it from a host that is not the portal’s embedding server, walks the content tree to views the portal never embeds, and then exports the underlying datasets rather than the filtered visuals. Because the principal is a token, not an interactive user, multi factor authentication on any human does nothing. In ATT&CK terms this is T1078, Valid Accounts, paired with T1213, Data from Information Repositories.

Why it works

The embed identity was granted more than it needed: the ability to export raw data and to reach content beyond the embedded set, with no row level security to keep it inside one tenant’s rows. A single leaked credential then becomes a full export path.

How to fix it

Containment is not a password reset. A PAT authenticates on its own, so you revoke the token in the BI service, and disable the owning service identity if it holds others. The non obvious move the scenario teaches is the eradication step: disable export and download for the embed identity, enforce row level security so it only ever resolves its own tenant slice, scope its content permissions to the embedded items, and store the new token in a secret manager. The BI service audit log, filtered to the token and the window, is the authoritative record of which views and datasets it actually reached.

Practice it

We built this as a GraphLattice Range scenario so security teams can rehearse the token revoke and the row level security fix before a real embed credential leaks.