IBM Process Mining 2.0.0 through 2.2.1 contains an authentication‑based flaw that allows an attacker with valid credentials to trigger excessive email notifications. The flaw arises from insufficient rate limiting, enabling the attacker to flood a target recipient with a large volume of emails. The result is a denial of service condition for the intended email service, potentially compromising confidentiality or availability of communications but not providing code execution or data exfiltration. This weakness corresponds to CWE‑770, insecure implementation of permission mechanism as applied to rate limiting.

The affected products are IBM Process Mining (On‑Premises) versions 2.0.0 through 2.2.1. Tuning or upgrading beyond 2.2.1 is required to eliminate the flaw.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, but the vulnerability requires authenticated access and relies on internal rate‑limiting logic, reducing the likelihood of public exploitation. The vulnerability is not listed in the CISA KEV catalog. Inferred from the description, the attack vector is likely via the application’s authenticated API or web interface where an attacker can repeatedly request email notification triggers. If exploited, the attacker can cause service disruption for the affected recipient’s mail environment but cannot gain additional privileges.