CVE-2025-36440
Received Received - Intake
Missing Function Level Access Control in IBM Concert Allows Data Exposure

Publication date: 2026-03-25

Last updated on: 2026-03-26

Assigner: IBM Corporation

Description
IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-03-26
Generated
2026-06-16
AI Q&A
2026-03-26
EPSS Evaluated
2026-06-15
NVD
CVE-2025-36440
EUVD
EUVD-2025-209029
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ibm concert From 1.0.0 (inc) to 2.2.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in IBM Concert versions 1.0.0 through 2.2.0 allows a local user to obtain sensitive information because the software lacks proper function level access control.

Impact Analysis

The vulnerability could allow a local user to access sensitive information that they should not be able to see, potentially leading to information disclosure and privacy risks.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-36440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart