CVE-2025-27368 Overview
IBM OpenPages 9.0 and 9.1 contain an information disclosure vulnerability in certain REST endpoints used by the OpenPages user interface. The endpoints enforce weaker access controls than expected, allowing an authenticated user to retrieve system metadata for areas beyond their intended authorization scope. The flaw is categorized under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. IBM has published a security advisory addressing the issue in the IBM Support Document.
Critical Impact
Authenticated OpenPages users can enumerate system metadata across governance, risk, and compliance domains outside their assigned permissions, exposing organizational structure and configuration data.
Affected Products
- IBM OpenPages 9.0.0
- IBM OpenPages 9.1.0
- REST endpoints backing the OpenPages user interface
Discovery Timeline
- 2025-11-12 - CVE-2025-27368 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27368
Vulnerability Analysis
IBM OpenPages is a governance, risk, and compliance (GRC) platform that exposes REST endpoints to power its web user interface. Several of these endpoints enforce authorization checks that are weaker than the surrounding application security model requires. An authenticated user who supplies valid credentials can query these endpoints and receive system metadata for GRC areas outside their assigned scope.
The disclosed data is limited to metadata about system objects rather than the underlying business records. Exposure of this metadata still reveals organizational structure, module configuration, and object taxonomy that can support reconnaissance for follow-on attacks against the GRC environment.
Root Cause
The root cause is inconsistent authorization enforcement at the REST API layer. The user interface assumes access is restricted at the presentation tier, while the underlying endpoints return metadata without validating that the caller has permission to view the requested area. This is a classic instance of [CWE-497], where privileged system information is reachable through a lower-trust interface.
Attack Vector
Exploitation requires network access to the OpenPages application and valid low-privilege user credentials. No user interaction is required. An attacker authenticates to OpenPages, then issues crafted requests directly to the affected REST endpoints to enumerate metadata for areas they are not authorized to view. Because the flaw only exposes information, integrity and availability are not directly affected.
No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-27368
Indicators of Compromise
- Repeated authenticated REST requests from a single OpenPages user session enumerating metadata endpoints across multiple GRC areas.
- User accounts accessing REST endpoints that correspond to modules or objects outside their role assignment.
- Elevated volumes of GET requests to OpenPages UI-backing REST paths that return metadata payloads.
Detection Strategies
- Enable verbose REST access logging on the OpenPages application server and forward logs to a SIEM for correlation with role assignments.
- Baseline normal per-user REST endpoint usage and alert on deviations, particularly access to endpoints not tied to the user's assigned modules.
- Review OpenPages audit trails for authenticated sessions that query metadata endpoints for areas outside the user's permission set.
Monitoring Recommendations
- Correlate OpenPages application logs with identity provider events to attribute REST activity to specific accounts.
- Track service accounts and low-privilege users for anomalous metadata query patterns following any credential change.
- Monitor for post-authentication reconnaissance behavior originating from OpenPages user sessions, including sequential probing of module identifiers.
How to Mitigate CVE-2025-27368
Immediate Actions Required
- Apply the fix documented in the IBM Support Document for OpenPages 9.0 and 9.1.
- Inventory OpenPages accounts and revoke unused or over-privileged credentials that could be abused for authenticated reconnaissance.
- Enforce multi-factor authentication on all OpenPages user accounts to raise the cost of credential-based access.
Patch Information
IBM has released a fix for CVE-2025-27368. Refer to the IBM Support Document for the specific interim fix or fix pack applicable to OpenPages 9.0.0 and 9.1.0. Apply the update in a test environment before promoting to production, and validate that UI-driven workflows continue to function after installation.
Workarounds
- Restrict network access to the OpenPages application to trusted corporate networks or VPN segments to reduce exposure of REST endpoints.
- Tighten role-based access control in OpenPages to enforce least privilege on all users who authenticate to the platform.
- If patching is delayed, front the OpenPages UI with a reverse proxy or web application firewall that logs and rate-limits access to REST endpoints.
# Configuration example
# Refer to the IBM Support Document for the authoritative remediation steps:
# https://www.ibm.com/support/pages/node/7250238
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
