The vulnerability allows an authenticated attacker to bypass authorization controls within IBM WebSphere Application Server, enabling the attacker to impersonate administrative users across the entire cell. This bypass compromises all administrative functions, potentially allowing full system control. The weakness is classified as CWE‑287, indicating a flaw in authentication or authorization logic.

IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.31 and 9.0.0.0 through 9.0.5.29 are affected. The impact spans the cell level, affecting all applications deployed within the cell.

The CVSS score is 8, indicating a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an attacker to have valid credentials within the cell; once authenticated, the attacker can exploit the authorization bypass to gain administrative privileges. Immediate remediation is strongly recommended due to the high potential impact.