A missing function level access control flaw in IBM Concert Software versions 1.0.0 through 2.2.0 permits a local user with sufficient login rights to read confidential data stored by the application. The vulnerability is a disclosure of sensitive information that could allow an attacker to compromise data confidentiality even though it does not provide code execution or denial of service capabilities.

IBM Concert Software, versions 1.0.0, 2.2.0, and any intermediate releases that have not applied the 2.3.1 patch, are susceptible to this flaw. The issue exists prior to the 2.3.1 release that fixes the access control checks.

The CVSS score of 5.1 indicates a moderate severity; the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the KEV catalog and does not provide remote access, limiting the attack to users who already have local login. A attacker must have local credentials to exploit the flaw and the path to obtain sensitive data is straightforward once this access is achieved.