IBM Concert EUVD-2026-104530

Exploitation requires that an attacker already hold a local account or interactive access on the same host where IBM Concert (versions 1.0 through 3.0.0) is running, and that a victim Concert user's web page content has been written to the local cache. The limiting factors are significant: there is no network-facing attack path (AV:L), the host must be multi-user or otherwise shared such that a second principal can read another user's cached files, and only confidentiality of cached web page data is at stake (no integrity or availability impact). It is not remotely exploitable and does not affect single-user/isolated deployments where no other local user can access the cache.

This is a low-to-moderate priority issue consistent with its CVSS 3.1 base score of 4.0. The vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) establishes that exploitation requires LOCAL access to the affected host - not network reachability - which substantially limits the realistic attacker population to users who already have a foothold or legitimate account on the same system. Impact is confined to a partial confidentiality loss (C:L) with no integrity or availability effect, matching CWE-525 (web browser/page cache containing sensitive information). No EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so there is no public exploit identified at time of analysis; the absence of these signals is expected for a low-severity local information-disclosure flaw and does not indicate active targeting. Note a mild tension in the signals: the CVSS vector sets PR:N (no privileges required), yet the description's premise - 'read by another user on the system' - inherently presumes the attacker is a local user of the host, so the PR:N rating is arguably generous; verify the exact access precondition with IBM. Overall this is a genuine but low-urgency defense-in-depth issue, not a high-CVSS-but-overstated finding nor an under-rated critical risk.

On a shared or multi-user host running IBM Concert, the application writes web page content to a locally stored cache that is accessible to other accounts on the same machine. A second local user browses or reads the cache files on disk and recovers sensitive information (e.g., session-related or application data) belonging to another Concert user. No public proof-of-concept exists, and the local attack vector (AV:L) with low complexity (AC:L) means the barrier is physical/local presence rather than technical sophistication.