The vulnerability arises when the caching mechanism in IBM Planning Analytics Local incorrectly marks user‑specific responses as publicly cacheable, enabling an attacker to retrieve sensitive information that should remain private. Key weakness: CWE‑524 Sensitive Information Exposure via Cache. The result is potential data exposure of confidential user data, violating confidentiality.

Affected versions include IBM Planning Analytics Local 2.1.0 through 2.1.17. The latest fixed release is 2.1.18, available from IBM Fix Central. The product runs on environments such as Microsoft Windows, as indicated by the CPE.

CVSS score 5.7 indicates moderate severity. EPSS is below 1 %, suggesting low likelihood of exploitation at present, and the flaw is not listed in CISA’s KEV catalog. Attack likely requires the ability to generate a cacheable page, possibly through authenticated requests, though the description does not specify authentication. The risk is moderate in organizations that rely on caching for performance but expose sensitive user data.