CVE-2026-13365

Analyzed Analyzed - Analysis Complete

Cross-Site Request Forgery in IBM Planning Analytics

Publication date: 2026-08-13

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-17

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-13365

EUVD

EUVD-2026-58360

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	planning_analytics_local	From 2.0.0 (inc) to 2.1.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

IBM Planning Analytics 2.0 and 2.1 Local has a cross-site request forgery (CSRF) vulnerability. This allows an attacker to trick a user into executing unauthorized actions on the website without their knowledge.

Detection Guidance

Detecting cross-site request forgery (CSRF) vulnerabilities typically involves monitoring web traffic for suspicious requests, checking for missing or improper CSRF tokens, and reviewing server-side logs for unauthorized actions. Since this vulnerability affects IBM Planning Analytics, inspect HTTP requests to the application for predictable or missing anti-CSRF tokens. Use tools like Burp Suite or OWASP ZAP to intercept and analyze requests. Check server logs for unusual POST or GET requests that modify data without proper authentication.

Impact Analysis

An attacker could perform actions on your behalf, such as modifying data or changing settings, without your consent. This could lead to unauthorized access or data manipulation.

Compliance Impact

This vulnerability could lead to unauthorized data access or changes, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Apply IBM Planning Analytics updates or patches as soon as they are available. Enable CSRF tokens in your IBM Planning Analytics configuration. Review and restrict user permissions to minimize potential impact. Monitor network traffic for unusual activity related to IBM Planning Analytics.

Hi! I’m here to help you understand CVE-2026-13365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70