An improper access control flaw in IBM Process Mining versions 2.0.0 through 2.2.1 allows a remote attacker to obtain sensitive information, as identified by the CWE-284 vulnerability type. The flaw permits unauthenticated or insufficiently authenticated users to view data that should be restricted to authorized personnel, leading to confidentiality loss.

IBM Process Mining On‑Prem editions from 2.0.0 up to and including 2.2.1 are affected. The advisory provides a fix for all instances in this version range, recommending an upgrade to version 2.2.1 IF001.

The vulnerability carries a CVSS score of 9.3, indicating a high severity impact. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the lack of a KEV listing does not diminish the need for remediation. The attack vector is inferred to be remote, requiring network access to the Process Mining environment. Successful exploitation would allow an attacker to bypass normal access controls and retrieve protected data, with potential system-wide or enterprise-wide consequences depending on user roles and data sensitivity.