IBM Planning Analytics 2.0 and 2.1 contain a flaw that allows a remote attacker to bypass the built‑in authentication mechanism and elevate privileges, resulting from improper validation of sub‑requests. The weakness is classed as authentication bypass (CWE‑288). Based on the description, it is inferred that successful exploitation would let an attacker gain full read, write, and delete access to the Planning Analytics environment, potentially compromising data integrity and confidentiality.

The affected products are IBM Planning Analytics Local versions 2.0 and 2.1. All builds from 2.1.0 through 2.1.23 are impacted. IBM recommends installing the latest release, Planning Analytics Local 2.1.24, which is available via Fix Central. The solution notes that the IBM Planning Analytics Cloud environment has been remediated; the CVE data does not explicitly state that the cloud is unaffected, but the remediation implies no known impact.

The CVSS score of 8.8 classifies this flaw as high severity. Exploitation requires only remote access to the application; no local or physical access is needed. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no observed exploitation yet. Nonetheless, the likely attack vector is over the network, and if the service is exposed to untrusted hosts, the risk remains non‑negligible.