STORAGE TS4500 LIBRARY · CVE-2026-19133 · Infrastructure
FIX → 1.12.0.4 ✓ verified
IBM's bulletin says the TS4500 Web UI and REST interfaces did not enforce authorization on password change requests. A lower-privileged authenticated user could use their own session to change another user's password and gain access to that account. Affects Storage TS4500 Library 1.1.1.6 - 1.12.0.3. IBM lists no workarounds.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM Storage TS4500 Library firmware 1.1.1.6 through 1.12.0.3 whose management Web UI or REST interface is reachable by more than one user. The attacker needs a valid low-privilege login. Teams on firmware 1.12.0.4 or later, or with no TS4500, can skip it.
Not affected if fixed-firmware, outside-affected-versions
Who cares firmware, ibm-storage, tape-library, ts4500
1.1.1.6 through 1.12.0.3 are listed as affected by IBMIBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.12.0.4
1.12.0 release, upgrade to firmware 1.12.0.4 Fix Pack or later, from IBM Fix Central