Authentication Bypass in IBM watsonx.data

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: IBM Corporation

Description

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of behavioral workflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2025-36333

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	watsonx.data_intelligence	5.2.0
ibm	watsonx.data_intelligence	5.2.1
ibm	watsonx.data_intelligence	5.2.2
ibm	watsonx.data_intelligence	5.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. It allows an authenticated user to perform unauthorized actions because the system does not properly enforce behavioral workflow controls.

Impact Analysis

The impact of this vulnerability is that an authenticated user could carry out actions they are not authorized to perform. This could lead to unauthorized changes or operations within the IBM watsonx.data intelligence environment, potentially compromising the integrity of data or workflows.

Hi! I’m here to help you understand CVE-2025-36333. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70