IBM watsonx Orchestrate CVE-2025-1837

Exploitation requires an authenticated user account on watsonx Orchestrate Cartridge for Cloud Pak for Data (versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2); the application improperly trusts server-side permission methods (CWE-650), letting a logged-in user perform actions beyond their authorization. The CVSS vector's UI:R indicates some user interaction may be involved, and the scope is unchanged (S:U), limiting impact to the vulnerable component. Limiting factors: a valid account is needed per the description (despite the vector's PR:N), impact is partial (C:L/I:L, no availability), and fixed versions are available from the vendor. Note the description-versus-vector disagreement on whether authentication is required - confirm with IBM before scoping as unauthenticated.

This is a moderate-severity authorization flaw (CVSS 5.4) that is best treated as a routine, scheduled-patch item rather than an urgent priority. The input provides no EPSS score, no CISA KEV listing, and no PoC/exploit reference, and the vendor-assigned severity is only medium with partial confidentiality and integrity impact and no availability impact. A notable conflict exists in the source data: the CVSS vector encodes PR:N (no privileges), yet the description explicitly states 'an authenticated user' must perform the action - these disagree, and the description's requirement for authentication should be weighted as the more specific signal, meaning real exploitation requires a valid account rather than anonymous access (verify privilege requirement with IBM advisory 7293785). The underlying weakness (CWE-650, improper server-side trust of permission methods) indicates a privilege/authorization boundary that can be subverted by a logged-in user, not a pre-authentication compromise. The vuln.today decision label is 'this_month', consistent with medium severity and the absence of active-exploitation signals. Overall this is a genuine but low-urgency authorization issue - not a high-CVSS-but-illusory risk, but also not an emergency.

An authenticated user of watsonx Orchestrate Cartridge for Cloud Pak for Data crafts a request that relies on the server improperly trusting the HTTP method or a server-side permission check, allowing them to invoke an action they are not authorized for. Because the vector is network-based with low complexity, the request can be issued remotely over the application's normal interface. No public exploit code or PoC reference is present in the provided data.