IBM Datacap version 9.1.7 through 9.1.9 and IBM Datacap Navigator version 9.1.7 through 9.1.9 allow an attacker to directly request URLs that are not exposed in the user interface. This bypasses the intended access controls and permits unauthorized viewing or manipulation of protected resources, potentially exposing sensitive data or configuration information to users who should not have access to them.

The vulnerable products are IBM Datacap and IBM Datacap Navigator, specifically versions 9.1.7, 9.1.8, and 9.1.9. Administrators of these installations should verify which instances are running those versions and assess any exposure of privileged URLs.

The CVSS score of 2.3 indicates a low severity assessment. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is remote network access to the web application, where an attacker can craft HTTP requests to the exposed URLs. No additional privileges beyond the ability to reach the application are required, but the impact is limited to unauthorized access to resources that are otherwise protected by the UI.