CVE-2025-36023: IBM Cloud Pak Information Disclosure Flaw

CVE-2025-36023 Overview

CVE-2025-36023 is an Insecure Direct Object Reference (IDOR) vulnerability in IBM Cloud Pak for Business Automation. The flaw affects versions 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002. An authenticated user can manipulate a user-controlled key to reference objects they do not own. Successful exploitation exposes sensitive user and system information. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
An authenticated network attacker can access sensitive user records and system metadata belonging to other tenants or accounts by tampering with object reference identifiers.

Affected Products

IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005
IBM Cloud Pak for Business Automation 24.0.1 through 24.0.1 IF002
Interim fixes IF001 and IF004 for the 24.0.0 branch are also in scope

Discovery Timeline

2025-08-08 - CVE-2025-36023 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36023

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in IBM Cloud Pak for Business Automation. Application endpoints accept an object identifier supplied by the client and return the associated resource without verifying that the caller owns or may access it. An authenticated user with low privileges can enumerate or guess identifiers to retrieve data belonging to other users. Retrieved data includes user profile fields and system-level information exposed through business automation APIs. The confidentiality impact is high, while integrity and availability are unaffected because the flaw only permits read operations.

Root Cause

The root cause is missing authorization checks on requests that reference objects by a user-controlled key. The application trusts the identifier supplied in the request instead of resolving the resource against the authenticated session context. This maps to CWE-639, where authorization decisions depend on data an attacker can modify.

Attack Vector

Exploitation requires network access and valid authentication to the Cloud Pak for Business Automation environment. The attacker submits crafted requests to affected endpoints, substituting the object identifier with values belonging to other users or system components. No user interaction and no elevated privileges are required. Because the request path is a normal application call, the traffic blends with legitimate activity, complicating identification.

No verified public proof-of-concept code is available. Refer to the IBM Support Page for vendor-supplied technical details.

Detection Methods for CVE-2025-36023

Indicators of Compromise

Repeated authenticated requests to Cloud Pak for Business Automation APIs with sequentially varying object identifiers.
Access patterns where a single account retrieves records associated with many other user IDs in a short window.
Unusual 200 OK responses returning sensitive fields to accounts that historically do not access those resources.

Detection Strategies

Review Cloud Pak audit logs for high-volume object retrieval calls originating from single low-privilege accounts.
Correlate authenticated user identity with the object owner field returned in API responses to flag mismatches.
Baseline normal per-user access to business automation records and alert on deviations that suggest enumeration.

Monitoring Recommendations

Forward Cloud Pak for Business Automation audit and access logs to a centralized analytics platform for retention and correlation.
Enable verbose API logging for endpoints that resolve objects by identifier, capturing caller identity and target resource ID.
Monitor authentication events for accounts that suddenly access administrative or cross-tenant resources.

How to Mitigate CVE-2025-36023

Immediate Actions Required

Apply the interim fixes published by IBM for the 24.0.0 and 24.0.1 branches as described on the IBM Support Page.
Inventory Cloud Pak for Business Automation deployments and confirm the running version and applied interim fix level.
Rotate credentials for any accounts suspected of being used to enumerate object identifiers.

Patch Information

IBM has published remediation guidance and interim fixes for the affected branches. Consult the IBM Support Page for the specific fix pack levels required for 24.0.0 and 24.0.1 deployments and apply them following IBM's documented upgrade procedure.

Workarounds

Restrict network access to the Cloud Pak for Business Automation management interfaces to trusted administrative networks until patching is complete.
Enforce least-privilege role assignments so that low-privilege accounts cannot reach endpoints that resolve objects by identifier.
Increase audit log retention and review to identify potential exploitation while remediation is in progress.

bash

# Configuration example
# Review IBM Support advisory for exact interim fix package names before applying
# https://www.ibm.com/support/pages/node/7241570