IBM Concert Software from version 1.0.0 through 3.0.0 contains an improper access control flaw (CWE‑276) that permits unauthorized modification of application files. Based on the description, it is inferred that an attacker who gains write access to the application directories can alter the software’s behavior, embed malicious code, or persist unauthorized changes, thereby compromising the integrity of the system.

The vulnerability affects IBM Concert Software for all released versions from 1.0.0 up to 3.0.0. IBM recommends moving to version 3.0.1.1, which incorporates the necessary access‑control fix. The affected CPEs are ibm:concert:1.0.0 and ibm:concert:3.0.0.

The CVSS base score of 6.2 indicates a moderate severity. No EPSS score is available and it is not listed in CISA’s KEV catalog. Lack of an explicit authentication requirement in the description suggests that any identity with permissions to modify the application files can exploit the flaw. Based on the description, it is inferred that exploitation requires write access to the application directories, which could be achieved through local privileges or potentially through remote interfaces that allow file modification.