EUVD-2026-58360
GHSA-7r55-v7vr-m7mw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CSRF inherently requires victim interaction (UI:R) and no attacker privileges (PR:N); high integrity impact reflects ability to forge arbitrary user actions; no data disclosure makes C:N accurate.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
AnalysisAI
Cross-site request forgery in IBM Planning Analytics 2.0 and 2.1 Local enables network-based attackers to force authenticated users into executing unauthorized actions against the platform without their knowledge. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials but must socially engineer an authenticated victim into visiting a malicious page or clicking a crafted link. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target user holds an active authenticated session in IBM Planning Analytics 2.0 or 2.1 Local at the moment they visit the attacker-controlled page (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 (High) score reflects high integrity impact (I:H) and low availability impact (A:L) with no confidentiality exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch addressing this vulnerability; the exact patched version and upgrade procedure should be obtained directly from the vendor advisory at https://www.ibm.com/support/pages/node/7283486. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Planning Analytics 2.0 and 2.1 Local installations in your environment and issue a security alert to users warning against clicking suspicious links or visiting untrusted websites while logged into Planning Analytics. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Planning Analytics
View allIBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validat
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Rated high severity (CVSS 8.
IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. Rated high severity (CVSS 7.8), this vul
IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. Rated high severity (CVSS 7.8), this vulnerabilit
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). Rated high severity (CVSS 7.3), this vul
IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou
A vulnerability exsists in IBM Planning Analytics 2.0 whereby avatars in Planning Analytics Workspace could be modified
IBM Planning Analytics 2.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. Rat
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability i
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set t
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability i
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today