IBM Maximo Application Suite – Location Service for Esri Component implements a schema‑less Custom Resource Definition that fails to enforce proper access control. The flaw allows a user to create or modify resources with privileges they do not possess, potentially granting unintended access to location data or administrative functions. This misuse of privileges can lead to data exposure, configuration tampering, or compromise of other services that rely on the Location Service.

The vulnerability exists in IBM Maximo Application Suite – Location Service for Esri Component versions 9.0.0, 9.1.0, and 9.2.0, with all sub‑minor releases within those major releases also affected.

The CVSS score of 7.2 classifies this issue as high severity, but the EPSS score is not available and it is not listed in the CISA KEV catalog. The vulnerability is caused by a schema‑less Custom Resource Definition that fails to enforce proper access control. Based on the description, it is inferred that an attacker who can authenticate to the Location Service API could craft requests to create or modify resources with elevated privileges, bypassing standard authorization checks. This could compromise the entire system where the service runs, potentially exposing all data and functions that depend on the Location Service.