{"id":"CVE-2026-19622","published":"2026-10-12T23:17:37.107","lastModified":"2026-10-15T18:14:24.330","description":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-288"],"vendors":["ibm"],"products":["planning analytics"],"references":[{"url":"https://www.ibm.com/support/pages/node/7291604","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Planning Analytics 2.0 and 2.1 contain a flawed authentication validation mechanism that allows remote attackers to bypass login requirements and gain elevated privileges. This vulnerability stems from improper handling of sub-requests, making it possible for an attacker to escalate their access level without proper credentials.","exploitability":"Exploitation is relatively straightforward for a remote attacker with network access, requiring no special preconditions beyond being able to send requests to the affected system, though successful exploitation requires understanding the specific sub-request structure.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full administrative access to IBM Planning Analytics installations, potentially compromising sensitive financial planning data and enabling unauthorized changes to critical business forecasts and reports.","remediation":"Upgrade to IBM Planning Analytics 2.2 or later to address this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","planning-analytics","remote"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:02:49.729Z"}}