CVE-2025-36351: IBM License Metric Tool Auth Bypass Vulnerability

CVE-2025-36351 Overview

CVE-2025-36351 is an access control vulnerability affecting IBM License Metric Tool versions 9.2.0 through 9.2.40. The flaw allows an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions. The weakness is classified under [CWE-284] (Improper Access Control) and stems from insufficient authorization checks on REST endpoints. IBM published a security advisory addressing the issue in September 2025.

Critical Impact
An authenticated low-privilege user can invoke REST API operations they are not authorized to perform, resulting in limited integrity impact on the License Metric Tool environment.

Affected Products

IBM License Metric Tool 9.2.0
IBM License Metric Tool versions 9.2.1 through 9.2.39
IBM License Metric Tool 9.2.40

Discovery Timeline

2025-09-29 - CVE-2025-36351 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36351

Vulnerability Analysis

IBM License Metric Tool provides software asset management and license consumption reporting for IBM and third-party products. The tool exposes a REST API used by administrators and integrated systems to query inventory, manage computer groups, and configure the platform.

CVE-2025-36351 exists because certain REST API endpoints do not consistently enforce authorization checks against the calling user's role. An authenticated user with limited privileges can invoke operations that should be restricted to higher-privileged roles. The vulnerability affects integrity, allowing unauthorized modifications, but does not directly expose confidential data or affect availability.

See the IBM Support advisory for the full list of affected endpoints and vendor guidance.

Root Cause

The root cause is improper access control [CWE-284] on REST API handlers. Authorization decisions rely on authentication state without verifying that the authenticated principal holds the role required to execute the requested action. This design gap enables horizontal or vertical privilege escalation within the REST interface.

Attack Vector

Exploitation requires network access to the License Metric Tool REST API and valid user credentials. An attacker authenticates using any existing account, then issues crafted REST requests to endpoints that lack proper role enforcement. No user interaction is required beyond the initial authentication.

No public proof-of-concept exploit is available. The EPSS probability is 0.236%, indicating low near-term exploitation likelihood in the wild.

Detection Methods for CVE-2025-36351

Indicators of Compromise

REST API requests from low-privilege accounts targeting administrative endpoints on the License Metric Tool server
Unexpected modifications to computer groups, contracts, or configuration records made by non-administrator accounts
Anomalous spikes in HTTP requests to /api/ paths on the License Metric Tool web tier

Detection Strategies

Enable and review License Metric Tool audit logs to correlate REST API invocations with user roles
Deploy web application firewall or reverse proxy rules that log all REST API calls and the associated authenticated identity
Compare user role assignments against the actions performed to identify authorization mismatches

Monitoring Recommendations

Forward License Metric Tool application and web server logs to a centralized SIEM for correlation
Alert on configuration or inventory changes performed by accounts outside the administrator group
Track failed and successful authentication events on the REST endpoint to establish a baseline of normal API consumers

How to Mitigate CVE-2025-36351

Immediate Actions Required

Upgrade IBM License Metric Tool to the fixed release identified in the IBM Support advisory
Audit existing user accounts and remove or downgrade accounts that no longer require access
Restrict network reachability of the License Metric Tool REST API to trusted administrative networks

Patch Information

IBM released a fix for CVE-2025-36351 addressing IBM License Metric Tool 9.2.0 through 9.2.40. Administrators should consult the IBM Support page for the exact fixed version and upgrade instructions applicable to their deployment.

Workarounds

Limit REST API exposure using firewall rules or a reverse proxy that only permits requests from authorized management hosts
Enforce least-privilege role assignments so that only necessary accounts retain API access
Rotate credentials for accounts that have historically had access to the License Metric Tool REST interface

bash

# Example firewall rule limiting REST API access to a management subnet
iptables -A INPUT -p tcp --dport 9081 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9081 -j DROP