{"id":"CVE-2026-103320","kind":"vulnerability","aliases":["CVE-2026-103320"],"related":[],"title":"IBM WebSphere Liberty: authenticated Reader role can obtain sensitive information","description":"IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.","summary":"IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 expose sensitive information to an authenticated user holding the Reader role. An attacker with a valid low-privilege account can read data they should not see.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm","java","liberty","vendor","websphere"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Liberty version against the affected range 17.0.0.3 through 26.0.0.10 (unknown exact check command in sources)\n- Review which accounts are assigned the Reader role in the Liberty authorization configuration","fix":null,"status":"open","published_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","triaged_at":"2026-11-08T16:18:59+00:00","updated_at":"2026-11-08T16:18:59+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T16:18:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM WebSphere Liberty: authenticated Reader role can obtain sensitive information","impact":"low","summary":"IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 expose sensitive information to an authenticated user holding the Reader role. An attacker with a valid low-privilege account can read data they should not see.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["websphere","liberty","java","ibm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated Reader user reads sensitive server information","analyst_note":"Confirm the affected configuration and the fixed version from IBM's security bulletin; the NVD entry gives only the range.","how_to_check":"- Check the installed Liberty version against the affected range 17.0.0.3 through 26.0.0.10 (unknown exact check command in sources)\n- Review which accounts are assigned the Reader role in the Liberty authorization configuration","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run IBM WebSphere Application Server Liberty within the affected version range and have users or accounts holding the Reader role. The sources do not say which configurations expose the data, so exposure beyond the version range is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4523,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103320':13A,16A '-2026':12A,15A '17.0.0.3':28B,63C '26.0.0.10':30B,65C 'account':50B 'allow':67C 'applic':24B,60C 'attack':43B 'authent':4A,36B,69C 'could':66C 'cve':11A,14A 'data':53B 'expos':31B 'hold':38B 'ibm':1A,17B,22B,58C 'inform':10A,33B,78C 'java':18B 'liberti':3A,19B,26B,62C 'low':48B 'low-privileg':47B 'obtain':8A,76C 'privileg':49B 'read':52B 'reader':5A,40B,73C 'role':6A,41B,74C 'see':57B 'sensit':9A,32B,77C 'server':25B,61C 'user':37B,70C 'valid':46B 'vendor':20B 'version':27B 'webspher':2A,21B,23B,59C","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM WebSphere Application Server Liberty within the affected version range and have users or accounts holding the Reader role. The sources do not say which configurations expose the data, so exposure beyond the version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibm","java","liberty","medium","vendor","websphere"],"campaign_type":null,"search_a":"'-103320':13A,16A '-2026':12A,15A 'authent':4A 'cve':11A,14A 'ibm':1A 'inform':10A 'liberti':3A 'obtain':8A 'reader':5A 'role':6A 'sensit':9A 'webspher':2A","search_b":"'17.0.0.3':28B '26.0.0.10':30B 'account':50B 'applic':24B 'attack':43B 'authent':36B 'data':53B 'expos':31B 'hold':38B 'ibm':17B,22B 'inform':33B 'java':18B 'liberti':19B,26B 'low':48B 'low-privileg':47B 'privileg':49B 'read':52B 'reader':40B 'role':41B 'see':57B 'sensit':32B 'server':25B 'user':37B 'valid':46B 'vendor':20B 'version':27B 'webspher':21B,23B","search_c":"'17.0.0.3':63C '26.0.0.10':65C 'allow':67C 'applic':60C 'authent':69C 'could':66C 'ibm':58C 'inform':78C 'liberti':62C 'obtain':76C 'reader':73C 'role':74C 'sensit':77C 'server':61C 'user':70C 'webspher':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103320","severity":null,"published_at":"2026-11-08T16:16:36+00:00","modified_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","fetched_at":"2026-11-08T16:18:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}