IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application. This vulnerability directly undermines authentication controls and permits elevation of privileges, exposing the application to potential data theft, tampering, and service disruption. The weakness is a clear instance of Authentication Bypass as identified by CWE‑863.

IBM Engineering Lifecycle Management – Jazz Foundation versions 7.0.3, 7.1.0, and 7.2.0 are affected. For 7.0.3 the applicable fix is iFix022, for 7.1.0 it is iFix010, and for 7.2.0 it is iFix002.

The CVSS score of 9.8 reflects a high severity level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the description states an unauthenticated remote attacker can trigger the flaw. Exploitation requires network connectivity to the Jazz Foundation server and the ability to write to server property files, after which the attacker can bypass authentication and access the application.