IBM Business Automation Workflow EUVD-2026-78870

Exploitation requires a valid authenticated account on the IBM Business Automation Workflow instance (CVSS PR:L) and network reachability to the web interface that exposes the affected import functionality - per the vendor description, the trigger is the restricted import action itself, so the attacker must be able to invoke that import operation. What limits the impact is that the flaw grants unauthorized access to import actions rather than full administrative control: confidentiality and integrity impact are both rated Low and there is no availability impact, so an attacker cannot directly destroy the platform or read the whole datastore. Successful exploitation depends on the environment actually exposing import endpoints to non-administrative users; deployments where role assignments already confine import rights to trusted administrators, or where the interface is not reachable from the attacker's network position, reduce practical exposure. Authentication requirements are confirmed as authenticated-only by the PR:L metric.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) describes a straightforward network-reachable flaw with no user interaction and no special complexity, but it requires a valid authenticated account (PR:L) and produces only limited confidentiality and integrity impact with no availability loss - that combination is what keeps the base score at 5.4 rather than critical. There is no CISA KEV listing and no public proof-of-concept reported, so this should be read as a realistic post-authentication authorization weakness rather than an imminent mass-exploitation event; nonetheless, even a mid-sized municipal IT team in leszno running Business Automation Workflow should treat it as urgent once a patch is staged, because the barrier to entry is simply one valid low-privileged credential. EPSS data was not supplied, so no probabilistic exploitation estimate can be layered on top of the CVSS score, and the scope is unchanged (S:U), meaning impact is confined to the affected workflow instance rather than cascading into adjacent systems.

An attacker who holds any valid low-privileged Business Automation Workflow account authenticates normally to the web interface and navigates to an import function that the application should have blocked for their role. Because no authorization check is enforced on that action, the import proceeds, allowing the attacker to inject or overwrite workflow content and read limited data that their role should not expose. The attack requires network reachability to the BAW interface and a working credential, but no user interaction and no elevated privileges.