{"id":"CVE-2026-123218","kind":"vulnerability","aliases":["CVE-2026-123218"],"related":[],"title":"IBM Aspera Faspex: crafted message lets a user gain full admin rights","description":"IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.","summary":"IBM Aspera Faspex versions 5.0.0 through 5.0.19 let an authorized user craft a specific message that bypasses user authorization. The attacker can gain full administrative privileges.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Aspera Faspex","fixed":["5.0.19 PL1"],"affected":">= 5.0.0, <= 5.0.19","ecosystem":"vendor"}],"ecosystems":[],"tags":["aspera-faspex","ibm-aspera","infrastructure","self-hosted"],"not_affected_if":["versions-outside-5.0.0-5.0.19"],"how_to_check":"Check the installed Faspex version (5.0.0 through 5.0.19 is affected). After upgrading, confirm the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1). IBM lists no workaround, so an unpatched 5.0.19 is still exposed.","fix":"Upgrade to IBM Aspera Faspex 5.0.19 PL1 (Fix Pack 1, Linux). Follow IBM's instructions in the bulletin and confirm the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1).","status":"open","published_at":"2026-11-07T04:17:28+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","triaged_at":"2026-11-07T04:47:49+00:00","updated_at":"2026-11-07T04:48:56+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T04:47:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Aspera Faspex: crafted message lets a user gain full admin rights","impact":"high","summary":"IBM Aspera Faspex versions 5.0.0 through 5.0.19 let an authorized user craft a specific message that bypasses user authorization. The attacker can gain full administrative privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-aspera","aspera-faspex","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains full administrative privileges on the Faspex server.","analyst_note":"Check the IBM security bulletin for Aspera Faspex 5.0.x to confirm the fixed version and any workaround; NVD alone gives no fix.","how_to_check":"- Check the installed Faspex version in the admin console or the product package, and compare it against `5.0.0` through `5.0.19`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-5.0.0-5.0.19"],"who_is_affected":"Organizations running IBM Aspera Faspex 5.0.0 through 5.0.19 where users hold accounts on the server. The sources do not say which configurations or roles are needed beyond an authorized user account. Installations on other versions are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000688,"input_tokens":4195,"output_tokens":537,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for Aspera Faspex 5.0.x to confirm the fixed version and any workaround; NVD alone gives no fix.","search":"'-123218':15A,18A '-2026':14A,17A '5.0.0':36B,61C '5.0.19':38B,63C 'admin':11A 'administr':56B,81C 'allow':65C 'aspera':2A,20A,23B,27B,33B,59C 'aspera-faspex':22B 'attack':52B 'author':41B,50B,67C,77C 'bypass':48B,75C 'could':64C 'craft':4A,43B,70C 'cve':13A,16A 'faspex':3A,21A,24B,34B,60C 'full':10A,55B,80C 'gain':9A,54B,79C 'host':31B 'ibm':1A,19A,26B,32B,58C 'ibm-aspera':25B 'infrastructur':28B 'let':6A,39B 'messag':5A,46B,73C 'privileg':57B,82C 'right':12A 'self':30B 'self-host':29B 'specif':45B,72C 'user':8A,42B,49B,68C,76C 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM Aspera Faspex 5, versions 5.0.0 through 5.0.19, where users have accounts on the server. IBM says an authorized user can craft a specific message to bypass authorization and gain full administrative privileges. IBM's CVSS vector rates it as network-reachable with no privileges required, so treat it as serious. Other versions are not listed as affected, but IBM only lists supported versions.","tier":"B","verified":{"fix":{"at":"2026-11-07T04:48:56Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass","run_id":1951},"products":{"at":"2026-11-07T04:48:56Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass","run_id":1951},"workarounds":{"at":"2026-11-07T04:48:56Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass","run_id":1951},"how_to_check":{"at":"2026-11-07T04:48:56Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass","run_id":1951},"who_affected":{"at":"2026-11-07T04:48:56Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass","run_id":1951}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["asperafaspex","ibmasperafaspex"],"ptokens":["aspera","faspex","ibm"],"labels":["asperafaspex","critical","ibmaspera","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-123218':15A,18A '-2026':14A,17A 'admin':11A 'aspera':2A,20A 'craft':4A 'cve':13A,16A 'faspex':3A,21A 'full':10A 'gain':9A 'ibm':1A,19A 'let':6A 'messag':5A 'right':12A 'user':8A","search_b":"'5.0.0':36B '5.0.19':38B 'administr':56B 'aspera':23B,27B,33B 'aspera-faspex':22B 'attack':52B 'author':41B,50B 'bypass':48B 'craft':43B 'faspex':24B,34B 'full':55B 'gain':54B 'host':31B 'ibm':26B,32B 'ibm-aspera':25B 'infrastructur':28B 'let':39B 'messag':46B 'privileg':57B 'self':30B 'self-host':29B 'specif':45B 'user':42B,49B 'version':35B","search_c":"'5.0.0':61C '5.0.19':63C 'administr':81C 'allow':65C 'aspera':59C 'author':67C,77C 'bypass':75C 'could':64C 'craft':70C 'faspex':60C 'full':80C 'gain':79C 'ibm':58C 'messag':73C 'privileg':82C 'specif':72C 'user':68C,76C","first_public_at":"2026-11-07T04:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123218","severity":null,"published_at":"2026-11-07T04:17:28+00:00","modified_at":"2026-11-07T04:17:29+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","fetched_at":"2026-11-07T04:45:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123218:1951","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass","severity":null,"published_at":"2026-11-07T04:48:56+00:00","modified_at":"2026-11-07T04:48:56+00:00","first_seen_at":"2026-11-07T04:48:56+00:00","fetched_at":"2026-11-07T04:48:56+00:00","note":"Read IBM bulletin (published 2026-11-07): affected 5.0.0-5.0.19, fix 5.0.19 PL1 (Fix Pack 1), no workarounds. No exploitation or PoC info in the bulletin; did not search social.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass"]}],"documents":[{"id":92830,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass","title":"IBM Security Bulletin: Aspera Faspex authorization bypass (CVE-2026-123218)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}