Clients of IBM Db2 installed with versions 11.5.0 through 11.5.9 or 12.1.0 through 12.1.4 can unintentionally expose sensitive information to any authenticated user that has permission to query the internal monitoring or event tables. The flaw provides read access to data that is not intended for the user, potentially revealing application or system secrets such as user roles, execution details, or customer data. This vulnerability falls under CWE‑538, which describes the improper restriction of information disclosure from internal data structures.

The affected products are IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server, across release lines 11.5 and 12.1. Versions 11.5.0‑11.5.9 and 12.1.0‑12.1.4 contain the flaw. Monitoring and event tables are the specific data structures that can be read by compromised users.

The CVSS score of 5.5 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV, suggesting no current known exploits. The ifuser must be authenticated to the database instance; an attacker would need valid credentials or compromise an account that has access to the monitoring/event tables. The flaw does not require network access or elevated privileges beyond those granted to the user querying the tables.