IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 have a defect that allows an authenticated user assigned the Reader role to access confidential data. The flaw exposes sensitive information to an actor who has legitimate read access, thereby compromising confidentiality but not authentication or integrity.

The affected product is IBM WebSphere Application Server Liberty, specifically releases 17.0.0.3 up to 26.0.0.10. This includes all builds within that range, regardless of configuration, as the vulnerability is tied to the core application server functionality.

The CVSS score of 4.3 indicates moderate severity. Exploitation requires valid credentials with the Reader role, implying local or remote authentication. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is unlikely to be actively exploited in the wild currently. An attacker would need to obtain a Reader credential, perhaps via phishing or credential reuse, and then query the application server to retrieve the sensitive data.