IBM Aspera Faspex 5.0.0 through 5.0.19 contains an authorization bypass flaw that allows an authorized user to craft a specific message and gain full administrative privileges, enabling unauthorized system configuration changes or data access. This is a classic privilege escalation vulnerability identified as CWE‑863.

Affected vendor is IBM, product Aspera Faspex. Vulnerable versions range from 5.0.0 up to and including 5.0.19. The IBM fix requires upgrading to version 5.0.19 PL1 on Linux platforms and validating the faspex-core container image to 5.0.19 (1ce4b13, Fix Pack: 1).

The vulnerability has a CVSS score of 9.8, indicating a critical impact. No EPSS value is available, and it is not yet listed in CISA’s KEV, but the high severity and the nature of the flaw mean that any authorized attacker can bypass authorization, making the exploit highly feasible for attackers with legitimate credentials. It is most likely triggered through crafted messages sent via the application’s messaging or API interfaces.