IBM Concert 1.0 through 3.0.0 uses cross‑origin resource sharing that is not restricted to trusted domains, allowing an attacker to issue requests from arbitrary origins. Because the server does not verify the calling domain, privileged actions that are normally protected can be performed, exposing sensitive data or functionalities. This is a form of authorization bypass rooted in improper CORS configuration (CWE-942).

Vulnerable versions are IBM Concert Software 1.0 to 3.0.0. The issue affects all deployments of these releases, regardless of installation type, as the misconfiguration exists in the core CORS handling for the web interface and APIs.

The CVSS score of 3.7 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is indeterminate, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by hosting a malicious web page and issuing cross‑origin requests to the Concert server; if the server tolerates such requests, the attacker can invoke privileged endpoints. The absence of a publicly known exploit means risk is primarily theoretical, but the impact could be significant if an attacker gains access to sensitive functions.