CVE-2025-36091

Published: Nov 3, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: psirt@us.ibm.com (Secondary)

Description

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment.

Affected (11)

Products: Ibm: Cloud Pak For Business Automation

Ibm

1 product

Cloud Pak For Business Automation

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Ibm Cloud Pak For Business Automation	Version 24.0.0
Ibm Cloud Pak For Business Automation	Version 24.0.0 interim_fix_001
Ibm Cloud Pak For Business Automation	Version 24.0.0 interim_fix_002
Ibm Cloud Pak For Business Automation	Version 24.0.0 interim_fix_003
Ibm Cloud Pak For Business Automation	Version 24.0.0 interim_fix_004
Ibm Cloud Pak For Business Automation	Version 24.0.1
Ibm Cloud Pak For Business Automation	Version 24.0.1 interim_fix_001
Ibm Cloud Pak For Business Automation	Version 24.0.1 interim_fix_002
Ibm Cloud Pak For Business Automation	Version 24.0.1 interim_fix_004
Ibm Cloud Pak For Business Automation	Version 25.0.0
Ibm Cloud Pak For Business Automation	Version 25.0.0 interim_fix_001

Related CWEs

CWE-283

Unverified Ownership

The product does not properly verify that a critical resource is owned by the proper entity.

References (1)

https://www.ibm.com/support/pages/node/7249999

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.