IBM Planning Analytics Local versions 2.1.0 through 2.1.17 lack proper access controls, allowing unauthorized users to retrieve sensitive application data and perform administrative functions. The flaw meets CWE‑200 and could expose confidential information and configuration details to attackers.

The affected product is IBM Planning Analytics Local on Windows. All installations running versions 2.1.0 to 2.1.17, inclusive, are vulnerable. IBM recommends applying the fixed release IBM Planning Analytics Local 2.1.18 (or later) from Fix Central; the cloud environment has already been remediated.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS value of less than 1% suggests exploitation is unlikely but not impossible, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector likely requires either unauthenticated or very low‑privilege authenticated access to the application, as the root cause is improper access controls. No public exploit is documented in the provided references.