IBM Verify Identity Access and IBM Security Verify Access allow some web servers to bypass authorization checks, potentially enabling an attacker to gain privileges or perform actions beyond their permissions. The vulnerability is a weakness in access control enforcement (CWE‑285) that does not expose remote code execution but can lead to unauthorized data access or configuration changes. The description does not indicate additional data compromise or denial of service; the risk centers on privilege escalation within the affected services.

Affected systems include IBM Verify Identity Access version 11.0.0 through 11.0.3, with an available fix in v11.0.3.1, and IBM Security Verify Access version 10.0.0 through 10.0.9.2, fixed by v10.0.9.3. Containerized deployments of both products in the same version ranges are also impacted. Any installation of the specified releases on a web server that does not enforce proper authorization controls is at risk.

The CVSS score of 5.9 indicates a moderate severity vulnerability. No EPSS score is provided, so the exploitation likelihood is unknown, and the listing is not included in the CISA KEV catalog. The vulnerability is inferred to be exploitable via remote web requests to the affected servers, possibly without authentication, by impersonating an authorized role. The exploit path would involve sending crafted requests that the server incorrectly authorizes, leading to unauthorized actions.