{"id":"CVE-2025-1837","aliases":["EUVD-2025-211278","GHSA-h693-cjhw-whmq"],"status":"published","title":"Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge","description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00181,"percentile":0.07765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-650"],"published":"2026-11-08T15:57:48Z","modified":"2026-11-08T18:30:25Z","products":[{"vendor":"ibm","product":"watsonx orchestrate cartridge for cloud pak for data"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293785","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1837"},{"url":"https://github.com/advisories/GHSA-h693-cjhw-whmq"}],"sources":{"cve":[{"id":"CVE-2025-1837","title":"Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge","description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.","status":"published","published":"2026-11-08T15:57:48.551Z","modified":"2026-11-09T17:09:25.556Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-650"],"updated_at":"2026-11-08T16:43:44.546804Z"}],"euvd":[{"id":"EUVD-2025-211278","description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.","status":"published","published":"2026-11-08T15:57:48Z","modified":"2026-11-09T17:09:25Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-08T20:13:57.133782Z"}],"ghsa":[{"id":"GHSA-h693-cjhw-whmq","title":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5...","description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.","status":"published","published":"2026-11-08T18:30:24Z","modified":"2026-11-08T18:30:25Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-650"],"updated_at":"2026-11-08T18:44:20.359761Z"}],"nvd":[{"id":"CVE-2025-1837","description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.","status":"published","published":"2026-11-08T16:16:35.76Z","modified":"2026-11-11T23:10:00.263Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-650"],"updated_at":"2026-11-09T20:15:34.896267Z"}]}}