CVE-2025-36091

MEDIUM

IBM Cloud Pak For Business Automation <25.0.0 - Privilege Escalation

Title source: llm
STIX 2.1

Description

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7249999

Scores

CVSS v3 4.3
EPSS 0.0004
EPSS Percentile 10.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-283
Status published
Products (3)
ibm/cloud_pak_for_business_automation 24.0.0 (5 CPE variants)
ibm/cloud_pak_for_business_automation 24.0.1 (4 CPE variants)
ibm/cloud_pak_for_business_automation 25.0.0 (2 CPE variants)
Published Nov 03, 2025
Tracked Since Feb 18, 2026