CVE-2026-17472

Received Received - Intake

IBM Concert RBAC Wildcard Permission Bypass Vulnerability

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: IBM Corporation

Description

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-17472

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	concert	From 1.0.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

IBM Concert 1.0.0 through 3.0.0 has a vulnerability where remote authenticated attackers can access or modify unauthorized resources. This occurs because Role-Based Access Control (RBAC) permission definitions use wildcards, allowing broader permissions than intended.

Impact Analysis

This vulnerability could allow attackers to read or alter sensitive data they should not have access to, leading to data breaches, unauthorized modifications, or potential system compromise. The high CVSS score (9.6) indicates significant risk.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA, as it enables unauthorized access to personal or health data. Organizations using affected IBM Concert versions may face regulatory penalties for failing to protect sensitive information.

Mitigation Strategies

Review and remove wildcard usage in RBAC permission definitions in IBM Concert 1.0.0 through 3.0.0. Ensure permissions are explicitly defined to prevent unauthorized access or modification.

Hi! I’m here to help you understand CVE-2026-17472. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70