This vulnerability arises from improper trust of server‑side permission methods in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data. An authenticated user can exploit the weakness to perform actions that should be restricted, enabling unauthorized operations. The flaw permits elevation of privileges within the platform, threatening the confidentiality and integrity of the data and services managed by the cartridge.

Affected by the vulnerability are IBM watsonx Orchestrate Cartridge for Cloud Pak for Data releases 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2. These versions were distributed under the IBM product line and lack the fix that is included in version 5.4.4. Staff or users with authenticated access to the system components are at risk.

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, so the historical exploitation probability cannot be quantified, and the CVE is not listed in CISA KEV. Because the vulnerability requires authentication, the likelihood of exploitation depends on the presence of privileged accounts and the adequacy of access controls. Attackers who obtain legitimate credentials can use the flaw to bypass intended permission checks and gain elevated privileges or otherwise manipulate services.