This vulnerability stems from an improper authentication mechanism that allows a remote attacker to bypass normal login requirements and obtain full administrative privileges. The flaw does not rely on any local user interaction; a remote actor can simply target the authentication endpoint to gain the same power as a legitimate administrator, enabling modification or deletion of sensitive planning data, configuration changes, or further exploitation of the system. Based on the description, it is inferred that the attacker must be able to reach the authentication service over the network to exploit this weakness. The associated CWE-288 indicates this is a flaw in authentication enforcement rather than an arbitrary code execution path.

IBM Planning Analytics Local versions 2.0 and 2.1 are affected. Specifically, all releases from IBM Planning Analytics Local 2.1.0 up to and including 2.1.23 contain the issue. IBM issued an update—version 2.1.24—to local installations, while the cloud‑based variant has already been remediated.

The vulnerability’s CVSS score of 8.8 places it in the high‑severity range, meaning its exploitation would provide attackers with critical administrative rights. EPSS data are currently unavailable, so the empirical likelihood of exploitation cannot be estimated. Based on the description, it is inferred that the attacker must be able to reach the service from the network, making the likely attack vector remote network access to the authentication endpoint. The absence of a public exploit and the fact that the flaw resides in authentication suggest that an attacker would need network access and an understanding of the vulnerable interface, but the high severity and potential for widespread impact mean that remediation is strongly recommended. The issue is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation at this time.