Vulnerability · Published Nov 12, 2025 · Assigned by ibm

CVE-2025-27368IBM OpenPages Information Disclosure

Medium 4.3

In plain English

A medium-severity security flaw in OpenPages from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 86.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond what the user is intended to view.

Affected products (as reported)

Vendor	Product	Versions
IBM	OpenPages	9.09.1

Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://www.ibm.com/support/pages/node/7250238 vendor-advisory, patch