An improper privilege management flaw in IBM Db2 allows a local attacker who possesses DBADM authority to elevate privileges. The vulnerability exposes a path that an attacker can traverse to gain higher level permissions within the database system, potentially compromising the confidentiality, integrity, and availability of stored data and services. This is a classic privilege escalation scenario identified as CWE-269.

IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server, versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, is vulnerable. The affected releases are listed in the Common Platform Enumeration strings that map to these product versions.

The CVSS score of 8.8 indicates a high impact and the attack is local, requiring DBADM authorization. The EPSS score is not provided, and the vulnerability is not currently listed in CISA’s KEV catalog. An attacker with database administrator privileges would be able to exploit the flaw to gain elevated permissions, but the exploit path requires local access and existing DBADM rights. The overall risk remains significant due to the potential for extensive compromise once privileges are escalated.