IBM Concert CVE-2026-3303

Exploitation requires that IBM Concert (versions 1.0 through 3.0.0) be configured with a permissive CORS policy that does not restrict Access-Control-Allow-Origin to trusted domains - per the description the allowed domain name 'is not being limited to only trusted domains.' A realistic attack further depends on a victim who holds an active authenticated Concert session and who is induced to load attacker-controlled web content, and on the browser sending credentials cross-origin; these requirements are why the vendor rates attack complexity High. The fix is available from IBM, so patched deployments are not exposed.

This is a low-severity issue (CVSS 3.7) and should be triaged as a low priority. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N indicates network-reachable, unauthenticated (PR:N) exploitation but with high attack complexity (AC:H) and only limited confidentiality impact (C:L), no integrity or availability impact. The AC:H rating is consistent with CORS abuse, which typically requires an authenticated victim to be lured to an attacker-controlled page so their browser issues cross-origin requests. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept, so there is no public exploit identified at time of analysis. Note a tension between the metadata and the narrative: the CVSS vector records only C:L with I:N, yet the description states an attacker 'could carry out privileged actions,' which implies an integrity dimension not reflected in the vendor base score - verify the true impact with IBM. Overall this is a genuine-but-minor configuration weakness, not a widespread-exploitation priority.

An attacker hosts a malicious web page and lures a user who is authenticated to IBM Concert into visiting it; the victim's browser then issues cross-origin requests that Concert honors because it reflects or over-permissively allows the request origin. The attacker's page can read responses or trigger privileged actions in the context of the victim's session. No public proof-of-concept is known, and the high complexity reflects the need for an authenticated victim and attacker-controlled web content.