IBM CVE-2025-14810

The CVSS 3.1 base score of 6.3 reflects a Medium-to-High severity vulnerability with moderate real-world exploitability. The attack vector is Network (AV:N) and requires Low privileges (PR:L), meaning any authenticated user can trigger the vulnerability with no special configuration. Attack complexity is Low (AC:L), indicating no exploitation barriers. The impact is Confidentiality, Integrity, and Availability all rated as Low (C:L/I:L/A:L), which moderates the overall score. From an SSVC perspective, this is exploitable by an insider (authenticated attacker) and is automatable given that an authenticated session is already present. The primary risk is information disclosure—a former employee or demoted user retaining access to sensitive business data, customer information, or data lineage metadata. The vulnerability does not require network tricks or race conditions; it is a logic flaw triggered by routine administrative actions. However, exploitation requires prior legitimate access and the victim must not notice privilege revocation immediately. Organizations with strong session monitoring and rapid privilege audit cycles face lower practical risk. Without a patch, organizations should prioritize this for Q1 2025 patching cycles, particularly if they frequently modify user roles or rapidly offboard contractors.

A system administrator removes a data analyst's access to customer records due to a team reorganization. However, the analyst's active session remains valid and cached with the original privilege set. The analyst continues to query sensitive customer information through their existing session token, and their queries succeed because the application never validates that their privileges were revoked. This scenario is particularly dangerous in environments with delayed privilege audit cycles, where days or weeks may pass before the retention of unauthorized access is discovered. No sophisticated exploit code is required—standard API calls or UI interactions made within the existing session are sufficient to trigger the flaw.