Vulnerability · Published Nov 3, 2025 · Assigned by ibm

CVE-2025-36091IBM Business Automation Insights unverified ownership

Medium 4.3

In plain English

A medium-severity security flaw in Cloud Pak For Business Automation from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 70.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment.

Affected products (as reported)

Vendor	Product	Versions
IBM	Cloud Pak For Business Automation	25.0.024.0.124.0.0

Weakness: CWE-283 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://www.ibm.com/support/pages/node/7249999 vendor-advisory, patch