The vulnerability allows the disclosure of internal schema information in IBM Concert 1.0 through 3.0.0. The internal schemas are exposed through the system’s suggestions interface, giving attackers the ability to glean configuration structure and potential mapping details. This disclosure can expose privileged data structures or administrative settings that could be leveraged in subsequent attacks. The weakness corresponds to CWE-209, which relates to exposure of sensitive information.

Affected systems are installations of IBM Concert Software released between version 1.0 and 3.0.0. The product is distributed under the IBM Concert label. Deployments include managed services and on-premises installations where the schema suggestion feature is enabled. The vulnerability is not limited to a specific deployment type.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed as a known exploited vulnerability by CISA. The likely attack vector is through the exposed schema suggestion endpoint, which can be accessed by users who have valid authentication or, if misconfigured, by unauthenticated remote users. Because the bug exposes only metadata rather than direct code execution, the exploitation risk is lower than high‑severity vulnerabilities but still warrants timely remediation.