IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data contain an improper token validation flaw that allows a privileged user to perform database operations and access sensitive information beyond their authorized scope. This flaw directly compromises data confidentiality and integrity by enabling unauthorized actions that should be restricted to the user’s granted privileges.

Vulnerable versions include IBM Db2 on Cloud Pak for Data 4.8, 5.0, 5.1, 5.2, and 5.3, as well as corresponding Db2 Warehouse on Cloud Pak for Data releases. The flaw exists in all listed editions and is only mitigated in the 5.4 release series.

The CVSS score of 6.0 indicates a moderate severity vulnerability. Exploitation requires a user with existing privileged access to the database environment, making the attack vector largely internal. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation at this time. However, because the flaw permits unauthorized escalation of privileges, administrators should prioritize remediation to prevent potential data breaches.