IBM DOORS Next CVE-2025-2139

Requires a valid authenticated account on the DOORS Next application (PR:L) with adjacent/network reach to it; no user interaction and no special non-default configuration are needed. The core enabling condition is the design flaw itself (CWE-602): review-deletion authorization is enforced only client-side in the UI, so any authenticated user can issue the underlying server request directly and delete reviews owned by other users. Limiting factors that reduce real-world risk: an authenticated account is mandatory (not anonymous), the impact is confined to integrity of review artifacts (no data disclosure, no service outage), and per IBM's AV:A the attacker likely needs adjacent network positioning rather than arbitrary internet reach.

This is a genuinely low-priority issue across every available signal. The IBM-assigned CVSS 3.1 base score is 3.5 (Low) with vector AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N: the only impact is a Low integrity hit (an authenticated user deleting other users' reviews), with no confidentiality or availability consequence and no scope change. EPSS reinforces this - 0.18% probability at only the 7th percentile, i.e. very low likelihood of exploitation. The vulnerability is NOT in CISA KEV and there is no public exploit code identified, so there is no evidence of active or opportunistic exploitation. One inconsistency to verify: the description states an 'authenticated user on the network,' which reads like network reach, yet IBM's vector specifies AV:A (Adjacent), implying constrained network positioning rather than full remote exploitability - verify the true access requirement with the vendor advisory. Separately, the input Tags include 'Information Disclosure,' which conflicts with the vector's C:N / I:L (this is an integrity/improper-access-control flaw, CWE-602, not a disclosure issue). Net: a real but minor broken-access-control bug relevant mainly to multi-user DOORS Next deployments; it does not warrant emergency patching and should be handled on a routine maintenance cycle.

An authenticated low-privilege user of IBM Engineering Requirements Management DOORS Next, noticing that review-deletion restrictions are enforced only in the browser UI (CWE-602), crafts a direct server request that bypasses those client-side checks. They then delete review artifacts created by other users, tampering with requirements-review records. No public exploit code or active exploitation has been identified; exploitation requires only a valid account and knowledge of the API call.