CVE-2026-17472
published 2026-09-22CVE-2026-17472: IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC…
PriorityP357critical9.6CVSS 3.1
AVNACLPRLUINSCCHIHAN
EPSS
0.30%
21.7th percentile
IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | concert | 1.0.0 – 3.0.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
ghsa_unreviewed·2026-09-23
CVE-2026-17472 [CRITICAL] CWE-269 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
VulDB
IBM Concert up to 3.0.0 privileges management
vuldb·2026-09-22·CVSS 9.6
CVE-2026-17472 [CRITICAL] IBM Concert up to 3.0.0 privileges management
A vulnerability marked as critical has been reported in IBM Concert up to 3.0.0. The affected element is an unknown function. The manipulation leads to improper privilege management.
This vulnerability is referenced as CVE-2026-17472. Remote exploitation of the attack is possible. No exploit is available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-22
Published