---
id: "CVE-2025-1837"
page: "https://infrastack.ai/live/CVE-2025-1837"
kind: "vulnerability"
aliases: ["CVE-2025-1837"]
title: "IBM watsonx Orchestrate: authenticated users can perform unauthorized actions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["cloud-pak-for-data", "ibm", "self-hosted", "vendor", "watsonx-orchestrate"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-08T16:16:35+00:00"
first_seen_at: "2026-11-08T16:18:33+00:00"
updated_at: "2026-11-08T16:18:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1837", "first_seen_at": "2026-11-08T16:18:33+00:00"}]
exploit_sources: []
---

# IBM watsonx Orchestrate: authenticated users can perform unauthorized actions

Link for people: https://infrastack.ai/live/CVE-2025-1837 (this .md is for agents)

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 trust server-side permission checks improperly. A logged-in user can perform actions they are not authorized to do.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed watsonx Orchestrate Cartridge version in Cloud Pak for Data against the affected ranges `4.8.4` to `4.8.5` and `5.0.0` to `5.4.2`

## Timeline

- 2026-11-08T16:18:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-1837

## From the sources

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_