EUVD-2026-78870
GHSA-4qhm-cjfg-jjv8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable web import endpoint with no user interaction or complexity, but a valid low-privileged account is required, matching PR:L and Low C/I with no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls.
AnalysisAI
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks on certain import operations, letting an authenticated user invoke restricted import actions they should not be permitted to perform. Successful abuse yields limited confidentiality and integrity impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) rather than full system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated account on the IBM Business Automation Workflow instance (CVSS PR:L) and network reachability to the web interface that exposes the affected import functionality - per the vendor description, the trigger is the restricted import action itself, so the attacker must be able to invoke that import operation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) describes a straightforward network-reachable flaw with no user interaction and no special complexity, but it requires a valid authenticated account (PR:L) and produces only limited confidentiality and integrity impact with no availability loss - that combination is what keeps the base score at 5.4 rather than critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch referenced by IBM at https://www.ibm.com/support/pages/node/7285930; because the advisory does not enumerate an exact fix version in the data available here, confirm the precise fix-pack or container image tag for your Business Automation Workflow release directly on that page before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
XML External Entity (XXE) injection in IBM Business Automation Workflow containers and traditional deployments allows an
IBM Business Automation Workflow, in both its container and traditional (on-premises) distributions, fails to restrict X
Improper TLS hostname verification in IBM Business Automation Workflow exposes high-privilege sessions to man-in-the-mid
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today