{"id":"CVE-2026-76052","aliases":["EUVD-2026-119670","GHSA-qmj8-f9w6-f3gp"],"status":"published","title":"The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher","description":"IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00108,"percentile":0.01172,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288"],"published":"2026-11-08T17:31:47Z","modified":"2026-11-08T18:30:33Z","products":[{"vendor":"ibm","product":"storage scale"},{"vendor":"ibm","product":"storage scale system"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7295211","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76052"},{"url":"https://github.com/advisories/GHSA-qmj8-f9w6-f3gp"}],"sources":{"cve":[{"id":"CVE-2026-76052","title":"The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher","description":"IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.","status":"published","published":"2026-11-08T17:31:47.8Z","modified":"2026-11-09T14:13:01.197Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-08T18:44:08.722914Z"}],"euvd":[{"id":"EUVD-2026-119670","description":"IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.","status":"published","published":"2026-11-08T17:31:47Z","modified":"2026-11-09T14:13:01Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-08T21:14:08.25264Z"}],"ghsa":[{"id":"GHSA-qmj8-f9w6-f3gp","title":"IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage...","description":"IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.","status":"published","published":"2026-11-08T18:30:27Z","modified":"2026-11-08T18:30:33Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-08T18:44:20.359761Z"}],"nvd":[{"id":"CVE-2026-76052","description":"IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.","status":"published","published":"2026-11-08T18:17:04.827Z","modified":"2026-11-09T15:17:21.307Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-09T18:15:14.951948Z"}]}}