{"id":"CVE-2026-14469","kind":"vulnerability","aliases":["CVE-2026-14469"],"related":[],"title":"IBM Storage Scale: authenticated users can reach filesets outside their control","description":"IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0  could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.","summary":"IBM Storage Scale versions 5.2.3.0 through 5.2.3.9 and 6.0.1.0 check authorization incorrectly. An attacker with a valid account can access and change filesets that are not theirs.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-storage","ibm-storage-scale","infrastructure","self-hosted"],"not_affected_if":["no-untrusted-authenticated-users"],"how_to_check":"- Check the installed Storage Scale version on each cluster node with `mmdiag --version` or `mmfsadm version`\n- Confirm whether your versions fall in 5.2.3.0 through 5.2.3.9 or 6.0.1.0","fix":null,"status":"open","published_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","triaged_at":"2026-11-08T18:22:58+00:00","updated_at":"2026-11-08T18:22:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:22:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Storage Scale: authenticated users can reach filesets outside their control","impact":"medium","summary":"IBM Storage Scale versions 5.2.3.0 through 5.2.3.9 and 6.0.1.0 check authorization incorrectly. An attacker with a valid account can access and change filesets that are not theirs.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-storage-scale","file-storage","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads or changes other filesets' data","analyst_note":"Find the IBM security bulletin for CVE-2026-14469 to confirm the fixed versions and any required configuration.","how_to_check":"- Check the installed Storage Scale version on each cluster node with `mmdiag --version` or `mmfsadm version`\n- Confirm whether your versions fall in 5.2.3.0 through 5.2.3.9 or 6.0.1.0","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-authenticated-users"],"who_is_affected":"Organisations running IBM Storage Scale 5.2.3.0 through 5.2.3.9 or 6.0.1.0 where users hold valid accounts and filesets are used to separate data between them. The sources do not describe the exact configuration needed to trigger it. Sites with a single trusted user group or no authenticated access to the cluster are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4545,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14469':14A,17A '-2026':13A,16A '5.2.3.0':33B,55C '5.2.3.9':35B,57C '6.0.1.0':37B,59C 'access':48B,66C 'account':46B 'allow':61C 'attack':42B,64C 'authent':4A,63C 'author':39B,76C 'beyond':70C 'chang':50B 'check':38B 'control':11A,72C 'could':60C 'cve':12A,15A 'due':73C 'file':19B 'file-storag':18B 'fileset':8A,51B,69C 'host':28B 'ibm':1A,22B,29B,52C 'ibm-storage-scal':21B 'improp':75C 'incorrect':40B 'infrastructur':25B 'manipul':68C 'outsid':9A 'reach':7A 'scale':3A,24B,31B,54C 'self':27B 'self-host':26B 'storag':2A,20B,23B,30B,53C 'user':5A 'valid':45B 'version':32B","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM Storage Scale 5.2.3.0 through 5.2.3.9 or 6.0.1.0 where users hold valid accounts and filesets are used to separate data between them. The sources do not describe the exact configuration needed to trigger it. Sites with a single trusted user group or no authenticated access to the cluster are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filestorage","ibmstoragescale","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-14469':14A,17A '-2026':13A,16A 'authent':4A 'control':11A 'cve':12A,15A 'fileset':8A 'ibm':1A 'outsid':9A 'reach':7A 'scale':3A 'storag':2A 'user':5A","search_b":"'5.2.3.0':33B '5.2.3.9':35B '6.0.1.0':37B 'access':48B 'account':46B 'attack':42B 'author':39B 'chang':50B 'check':38B 'file':19B 'file-storag':18B 'fileset':51B 'host':28B 'ibm':22B,29B 'ibm-storage-scal':21B 'incorrect':40B 'infrastructur':25B 'scale':24B,31B 'self':27B 'self-host':26B 'storag':20B,23B,30B 'valid':45B 'version':32B","search_c":"'5.2.3.0':55C '5.2.3.9':57C '6.0.1.0':59C 'access':66C 'allow':61C 'attack':64C 'authent':63C 'author':76C 'beyond':70C 'control':72C 'could':60C 'due':73C 'fileset':69C 'ibm':52C 'improp':75C 'manipul':68C 'scale':54C 'storag':53C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14469","severity":null,"published_at":"2026-11-08T18:17:02+00:00","modified_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","fetched_at":"2026-11-08T18:22:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}