---
id: "CVE-2025-36252"
kind: "vulnerability"
aliases: ["CVE-2025-36252"]
title: "IBM TS4500 tape library: sessions not invalidated, allowing user impersonation"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-storage", "infrastructure", "tape-library", "ts4500"]
not_affected_if: ["unknown"]
published_at: "2026-10-19T23:17:35+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T04:01:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36252", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# IBM TS4500 tape library: sessions not invalidated, allowing user impersonation

The IBM TS4500 Tape Library and Diamondback Tape Library management software from version 1.1.1.6 through 1.12.0.3 does not invalidate sessions. An authenticated user can impersonate another user on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-36252

## From the sources

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_