The vulnerability in IBM Sterling Partner Engagement Manager allows an attacker to retrieve sensitive user information by exploiting an expired access token. Key detail from vendor description: "IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token." This improper token validation is an instance of Improper Authentication (CWE‑324) that can lead to information disclosure and compromise data confidentiality.

IBM Sterling Partner Engagement Manager Essentials Edition and Standard Edition are affected. Key detail from vendor advisory: affected versions are 6.2.3.0–6.2.3.5 and 6.2.4.0–6.2.4.2. Remediated versions are 6.2.3.6 for Essentials and 6.2.4.3 for Standard.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is below 1%, suggesting low current exploitation likelihood. Vendor advisory notes that this vulnerability is not listed in the KEV catalog. The flaw requires access to an expired token, which could be obtained through authentication flows or configuration errors; the description does not detail any additional prerequisites, so the attack vector is inferred to be reachable to either internal or external actors with token access.