EIP-2026-119380

The exploit demonstrates a privilege escalation and information disclosure vulnerability in IBM BPM by allowing an authenticated but non-privileged user to modify administrator account preferences via the `setPreference` action. It includes steps to enumerate users and manipulate email or LDAP attributes to hijack notifications or reset passwords.