IBM Planning Analytics CVE-2026-17475

Exploitation requires the attacker to hold a valid, low-privileged authenticated account on an IBM Planning Analytics 2.0 or 2.1 instance (PR:L) that is network-reachable (AV:N); no user interaction and no special non-default configuration is indicated by the data. The specific trigger is invoking folder/application delete functionality where the server performs improper functional-level access control, allowing the request to act on objects owned by other users. The key limiting factor is the authentication prerequisite - an anonymous/external attacker cannot exploit this; it is realistically an insider or compromised-credential threat, and impact is limited to deletion (integrity/availability) rather than data disclosure.

This is a moderate-severity authorization flaw (CWE-285, improper functional-level access control) with CVSS 7.1 driven primarily by the A:H availability impact - an attacker can destroy other users' folders and applications. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low-privilege authenticated access with no user interaction, which is consistent with the description's 'remote authenticated attacker.' No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this appears to be a vendor-reported (IBM) issue rather than a priority threat under active attack. The realistic risk is contained because exploitation presupposes a valid account on the Planning Analytics instance; the main danger is a malicious or compromised internal user causing destructive, cross-tenant data loss. Note the input 'Authentication Bypass' tag conflicts with both CWE-285 and the explicit requirement for an authenticated attacker - this is an authorization/access-control defect, not an authentication bypass.

A low-privileged but authenticated user of IBM Planning Analytics issues application-level requests to delete folders and applications that belong to other users, which the server fails to authorize against the requester's identity. No public exploit code was identified; exploitation requires only a valid account and low attack complexity, enabling destructive tampering with other tenants' or colleagues' content.