IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 do not invalidate a user session after privileges have been changed. If an authenticated user gains higher privileges, the existing session remains active, allowing continued access to data that should no longer be reachable. This weakness is classified as CWE‑613 (Insufficient Session Expiration) and can lead to unauthorized retention of sensitive information.

The vulnerability applies to IBM InfoSphere Information Server deployed on IBM AIX, Linux, and Microsoft Windows operating systems. All component versions from 11.7.0.0 up to and including 11.7.1.6 are affected. The vendor recommends applying the available product updates: IBM InfoSphere Information Server 11.7.1.0, 11.7.1.6, or the 11.7.1.6 Service Pack 2, depending on the environment.

The CVSS v3.1 score of 6.3 indicates medium severity; network access is required but no user interaction is needed, with low attack complexity and low required privileges. The EPSS probability is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation is uncommon. Still, because the issue allows an authenticated user to maintain elevated access, it poses a significant risk in environments where credential compromise or privilege escalation is feasible.