A remote attacker can bypass security restrictions in IBM DataPower Gateway because of improper authorization controls. The flaw allows an authenticated or unauthenticated user to perform privileged operations that should be denied, potentially leading to data exposure, configuration changes, or further lateral movement within the network.

Vendors affected include IBM DataPower Gateway versions 10.5.0, 10.6.0, 10.6CD, and 11.0.0. The specific vulnerable releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6CD 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

The CVSS score of 7.4 indicates a high severity with medium to high impact. No EPSS score is available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely to be remote, requiring network connectivity to the affected DataPower Gateway; an attacker would need to craft a request that exploits the authorization bypass to gain unauthorized access to protected resources.