Improper Channel Restriction in IBM Concert Enables Unauthorized Actions

Publication date: 2026-03-25

Last updated on: 2026-03-26

Assigner: IBM Corporation

Description

IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-25

Last Modified

2026-03-26

Generated

2026-07-06

AI Q&A

2026-03-26

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36438

EUVD

EUVD-2025-209027

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	concert	From 1.0.0 (inc) to 2.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-923	The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM Concert versions 1.0.0 through 2.2.0. It allows a privileged user to perform unauthorized actions because the software does not properly restrict channel communication to only the intended endpoints.

Impact Analysis

The impact of this vulnerability is that a privileged user could exploit it to carry out unauthorized actions within the system. This could lead to potential misuse or manipulation of the application, compromising its integrity.

Hi! I’m here to help you understand CVE-2025-36438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70