The vulnerability in IBM Storage TS4500 Library allows an authenticated user to keep an active session after logging out, enabling the user to log in as another user without reauthentication. This weakness permits impersonation of privileged accounts, potentially allowing manipulation of storage resources or data access that the impersonated user has permission to perform. The underlying issue is improper session expiration, identified as CWE‑613.

IBM Storage TS4500 Library firmware versions 1.1.1.6 through 1.12.0.3 are affected. The issue arises in the management interface of the tape library and does not apply to firmware versions 1.12.0.4 and later, which contain the fix.

The CVSS score of 5.5 indicates moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. EPSS is unavailable, so the exact likelihood of exploitation cannot be quantified from the data. The attack requires an authenticated session, meaning an attacker must first obtain valid credentials to the library system; once they do, the lack of session invalidation allows the attacker to impersonate other logged‑in users in the same environment. If a privileged user is compromised, the risk of data exfiltration or configuration changes is significant.