{"id":"CVE-2025-1837","kind":"vulnerability","aliases":["CVE-2025-1837"],"related":[],"title":"IBM watsonx Orchestrate: authenticated users can perform unauthorized actions","description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.","summary":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 trust server-side permission checks improperly. A logged-in user can perform actions they are not authorized to do.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-pak-for-data","ibm","self-hosted","vendor","watsonx-orchestrate"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed watsonx Orchestrate Cartridge version in Cloud Pak for Data against the affected ranges `4.8.4` to `4.8.5` and `5.0.0` to `5.4.2`","fix":null,"status":"open","published_at":"2026-11-08T16:16:35+00:00","first_seen_at":"2026-11-08T16:18:33+00:00","triaged_at":"2026-11-08T16:18:58+00:00","updated_at":"2026-11-08T16:18:58+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T16:18:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM watsonx Orchestrate: authenticated users can perform unauthorized actions","impact":"medium","summary":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 trust server-side permission checks improperly. A logged-in user can perform actions they are not authorized to do.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","watsonx-orchestrate","cloud-pak-for-data","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user performs actions beyond their permissions","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and any required configuration; the NVD entry gives no fix.","how_to_check":"- Check the installed watsonx Orchestrate Cartridge version in Cloud Pak for Data against the affected ranges `4.8.4` to `4.8.5` and `5.0.0` to `5.4.2`\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM watsonx Orchestrate Cartridge on Cloud Pak for Data in the affected version ranges. Exposure requires an authenticated account on the platform. Installations outside those ranges are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4575,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1837':12A,15A '-2025':11A,14A '4.8.4':39B,74C '4.8.5':41B,76C '5.0.0':43B,78C '5.4.2':45B,80C 'action':9A,60B,89C 'allow':82C 'authent':4A,84C 'author':64B 'cartridg':32B,68C 'check':51B 'cloud':17B,34B,70C 'cloud-pak-for-data':16B 'could':81C 'cve':10A,13A 'data':20B,37B,73C 'due':90C 'host':24B 'ibm':1A,21B,29B,65C 'improp':52B,92C 'log':55B 'logged-in':54B 'method':99C 'orchestr':3A,28B,31B,67C 'pak':18B,35B,71C 'perform':7A,59B,87C 'permiss':50B,98C 'self':23B 'self-host':22B 'server':48B,96C 'server-sid':47B,95C 'side':49B,97C 'trust':46B,93C 'unauthor':8A,88C 'user':5A,57B,85C 'vendor':25B 'version':38B 'watsonx':2A,27B,30B,66C 'watsonx-orchestr':26B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM watsonx Orchestrate Cartridge on Cloud Pak for Data in the affected version ranges. Exposure requires an authenticated account on the platform. Installations outside those ranges are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudpakfordata","ibm","medium","selfhosted","vendor","watsonxorchestrate"],"campaign_type":null,"search_a":"'-1837':12A,15A '-2025':11A,14A 'action':9A 'authent':4A 'cve':10A,13A 'ibm':1A 'orchestr':3A 'perform':7A 'unauthor':8A 'user':5A 'watsonx':2A","search_b":"'4.8.4':39B '4.8.5':41B '5.0.0':43B '5.4.2':45B 'action':60B 'author':64B 'cartridg':32B 'check':51B 'cloud':17B,34B 'cloud-pak-for-data':16B 'data':20B,37B 'host':24B 'ibm':21B,29B 'improp':52B 'log':55B 'logged-in':54B 'orchestr':28B,31B 'pak':18B,35B 'perform':59B 'permiss':50B 'self':23B 'self-host':22B 'server':48B 'server-sid':47B 'side':49B 'trust':46B 'user':57B 'vendor':25B 'version':38B 'watsonx':27B,30B 'watsonx-orchestr':26B","search_c":"'4.8.4':74C '4.8.5':76C '5.0.0':78C '5.4.2':80C 'action':89C 'allow':82C 'authent':84C 'cartridg':68C 'cloud':70C 'could':81C 'data':73C 'due':90C 'ibm':65C 'improp':92C 'method':99C 'orchestr':67C 'pak':71C 'perform':87C 'permiss':98C 'server':96C 'server-sid':95C 'side':97C 'trust':93C 'unauthor':88C 'user':85C 'watsonx':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-1837","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1837","severity":null,"published_at":"2026-11-08T16:16:35+00:00","modified_at":"2026-11-08T16:16:35+00:00","first_seen_at":"2026-11-08T16:18:33+00:00","fetched_at":"2026-11-08T16:18:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}