Description
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Published: 2026-08-13
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Planning Analytics 2.0 and 2.1 Local are vulnerable to cross‑site request forgery, enabling an attacker to trigger state‑changing actions on the site with the credentials of a trusted user. The flaw can lead to unauthorized access to or modification of data and configuration settings, potentially compromising both confidentiality and integrity on the affected system.

Affected Systems

The affected products are IBM Planning Analytics Local versions 2.0 and 2.1, specifically 2.1.0 through 2.1.22. Version 2.1.23 has been released to remediate the issue. The IBM Planning Analytics Cloud environment has been remediated and is not affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, classifying it as high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a user who, while authenticated to the Planning Analytics web interface, is tricked into visiting a malicious site that submits forged requests. Successful exploitation would require a valid session cookie to carry out arbitrary actions on the behalf of the victim.

Generated by OpenCVE AI on August 13, 2026 at 20:40 UTC.

Remediation

Vendor Solution

It is strongly recommended that you apply the most recent security updates:  Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.22 IBM Planning Analytics Local 2.1.23 is now available for download from Fix Central https://w3.ibm.com/w3publisher/capa-release-announcements/2026-releases/pa-2026-releases IBM Planning Analytics Cloud environment has been remediated.

OpenCVE Recommended Actions

  • Deploy IBM Planning Analytics Local version 2.1.23 or later to address the CSRF flaw.
  • Ensure that Cross‑Site Request Forgery protection is enabled and that all state‑changing requests contain a valid CSRF token.
  • Configure session cookies with the SameSite and Secure attributes to reduce the risk of token theft and unsolicited requests.

Generated by OpenCVE AI on August 13, 2026 at 20:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Title IBM Planning Analytics Local is affected by security vulnerabilities
First Time appeared Ibm
Ibm planning Analytics
Weaknesses CWE-352
CPEs cpe:2.3:a:ibm:planning_analytics:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:planning_analytics:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:planning_analytics:2.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm planning Analytics
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'}

Subscriptions

Ibm Planning Analytics
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-13T19:34:02.627Z

Reserved: 2026-06-25T18:53:48.597Z

Link: CVE-2026-13365

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-13T20:17:13.773

Modified: 2026-08-13T20:36:48.443

Link: CVE-2026-13365

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T20:45:02Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)