CVE-2025-36091 Overview
CVE-2025-36091 affects IBM Cloud Pak for Business Automation versions 25.0.0, 24.0.1, and 24.0.0. An authenticated user can trigger invalid ownership assignment on dashboards, rendering them inaccessible to legitimate users. The weakness is categorized as Possible Deadlock [CWE-283], reflecting a broken access control condition rather than data exposure. Exploitation requires only low privileges on the network-accessible interface and yields an availability impact against dashboard consumers. Confidentiality and integrity remain unaffected, but productivity loss can be significant for teams that depend on the affected dashboards.
Critical Impact
Authenticated users can lock legitimate users out of business automation dashboards through invalid ownership assignment, disrupting operational visibility.
Affected Products
- IBM Cloud Pak for Business Automation 25.0.0 (including interim fix 001)
- IBM Cloud Pak for Business Automation 24.0.1 (including interim fixes 001, 002, 004)
- IBM Cloud Pak for Business Automation 24.0.0 (including interim fixes 001–004)
Discovery Timeline
- 2025-11-03 - CVE-2025-36091 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36091
Vulnerability Analysis
The flaw resides in how IBM Cloud Pak for Business Automation assigns and enforces ownership on dashboard resources. An authenticated user can perform actions that reassign or corrupt the ownership state of a dashboard. Once ownership is invalid, the platform's access checks reject requests from legitimate users who previously held access. The result is a denial-of-service condition scoped to dashboard availability. The bug does not expose data or allow modification of dashboard contents, but it removes a business function from users who depend on it. Recovery requires administrative intervention to restore correct ownership metadata.
Root Cause
The issue maps to [CWE-283: Unverified Ownership]. The application accepts ownership assignment operations without adequately validating that the resulting owner reference is valid and that the requesting user is authorized to change ownership. This design gap allows an authenticated actor to place a dashboard into a state where no legitimate user satisfies the access policy.
Attack Vector
Exploitation is remote and authenticated. An attacker with a low-privilege account interacts with the dashboard management interface over the network. No user interaction is required from the victim. The attacker performs an ownership operation that leaves the dashboard in an inaccessible state for its intended users. Because the operation is functionally valid at the API layer, standard application logs may record it as normal user activity.
No public proof-of-concept or exploit code is available for CVE-2025-36091. Refer to the IBM Support Page for vendor-supplied technical detail.
Detection Methods for CVE-2025-36091
Indicators of Compromise
- Reports from users unable to open previously accessible dashboards in IBM Cloud Pak for Business Automation.
- Audit log entries showing dashboard ownership changes performed by non-administrative accounts.
- Repeated ownership reassignment actions originating from a single authenticated session.
Detection Strategies
- Enable and centralize application audit logging for the Business Automation dashboard component, focusing on ownership and permission mutation events.
- Alert on ownership assignment operations that target dashboards not created by the requesting user.
- Correlate help-desk tickets about lost dashboard access with recent ownership change events on the same resource.
Monitoring Recommendations
- Baseline the frequency of dashboard ownership changes per user role and alert on deviations.
- Monitor administrative recovery actions on dashboards as a signal that an invalid ownership state occurred.
- Forward Cloud Pak audit events to a central analytics platform for cross-user correlation and retention.
How to Mitigate CVE-2025-36091
Immediate Actions Required
- Apply the fix referenced in the IBM Support Page for CVE-2025-36091.
- Inventory Cloud Pak for Business Automation deployments and confirm versions against the affected list (24.0.0, 24.0.1, 25.0.0).
- Review recent audit logs for anomalous ownership changes on dashboards and restore legitimate ownership where needed.
Patch Information
IBM has published remediation guidance and interim fixes for the affected releases. Consult the IBM Support Page for the specific interim fix or upgrade path applicable to each affected version. Deploy the vendor-supplied fix in test environments before production rollout, then validate that dashboard ownership operations continue to function for administrators.
Workarounds
- Restrict dashboard ownership management operations to administrative roles through role-based access control adjustments where the platform permits.
- Reduce the number of low-privilege accounts with access to shared or business-critical dashboards until the fix is applied.
- Establish an operational runbook so administrators can quickly restore ownership on dashboards reported as inaccessible.
# Configuration example
# No vendor-published configuration workaround is available for CVE-2025-36091.
# Follow the remediation steps documented at:
# https://www.ibm.com/support/pages/node/7249999
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
