IBM watsonx Orchestrate CVE-2026-2477

Requires a valid authenticated low-privileged user account on an affected deployment (PR:L); the attacker then invokes administrative API endpoints directly over the network, bypassing UI-level access restrictions. Affected configurations are IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2. The primary limiting factor is that exploitation is not possible without first authenticating - an external unauthenticated attacker cannot reach this directly - and impact is confined to integrity (unauthorized execution of privileged functions) with no confidentiality or availability effect stated.

This is a missing-authorization flaw (CWE-862) in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data where backend endpoints do not re-check authorization, letting a low-privileged authenticated user call administrative APIs directly. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (6.5, Medium) shows network reach, low complexity, and no user interaction, but PR:L means a valid account is required - this is not an unauthenticated internet-facing break. Impact is integrity-only (I:H) with no stated confidentiality or availability loss, consistent with unauthorized invocation of privileged functions rather than data theft or outage. No EPSS score, KEV listing, or PoC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the vendor-assigned priority is this_month, not an emergency. Net real-world risk is moderate and insider/post-compromise weighted: dangerous where many low-trust users already hold accounts, but gated behind authentication and limited to a niche enterprise product, so this is a genuine but non-urgent priority rather than a high-CVSS-but-trivial issue.

A user who already holds a low-privileged account on an affected watsonx Orchestrate Cartridge deployment crafts direct API requests to administrative endpoints that the UI would normally hide, and the backend executes them because it never revalidates authorization. Because AC:L and UI:N, no special timing or victim interaction is needed, but PR:L means the attacker must first authenticate. No public exploit was identified at time of analysis, so an attacker would need to discover the privileged endpoints themselves.