Unauthorized Access via Unlinked URL in IBM Datacap

Publication date: 2026-06-22

Last updated on: 2026-06-26

Assigner: IBM Corporation

Description

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-06-26

Generated

2026-07-13

AI Q&A

2026-06-22

EPSS Evaluated

2026-07-11

NVD

CVE-2026-9610

EUVD

EUVD-2026-38287

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datacap	9.1.7
ibm	datacap_navigator	9.1.7
ibm	datacap_navigator	9.1.8
ibm	datacap_navigator	9.1.9
ibm	datacap	9.1.8
ibm	datacap	9.1.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-425	The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM Datacap versions 9.1.7, 9.1.8, and 9.1.9, as well as IBM Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9. It allows access to resources or functionality that are not linked or visible in the user interface but can be accessed by directly requesting the URL. This means that intended access controls can be bypassed by users who know or guess the direct URL.

Impact Analysis

The vulnerability can lead to unauthorized access to certain resources or functionalities within IBM Datacap and Datacap Navigator. Although the access requires knowledge of the direct URL and the vulnerability has a low CVSS base score of 2.3, it could still expose sensitive information or functionality that should be restricted, potentially leading to information disclosure.

Hi! I’m here to help you understand CVE-2026-9610. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70