CVE-2026-112369 · Vendor
NO FIX YET
IBM Process Mining versions 2.0.0 through 2.2.1 rely on client-side checks for security controls that should be enforced on the server. A logged-in user can therefore perform actions they are not authorized to take.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Process Mining in the affected version range are exposed. The flaw requires a valid user account, so the risk is highest where many people have logins. Deployments outside 2.0.0 through 2.2.1 are not affected by this advisory.
Not affected if auth-required
Who cares ibm-process-mining, self-hosted
No fix yet, per the sources.
IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.