{"id":"CVE-2026-19133","kind":"vulnerability","aliases":["CVE-2026-19133"],"related":[],"title":"IBM TS4500 tape library: a low-privileged user can change another user's password and take over the account","description":"IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization.","summary":"IBM's bulletin says the TS4500 Web UI and REST interfaces did not enforce authorization on password change requests. A lower-privileged authenticated user could use their own session to change another user's password and gain access to that account. Affects Storage TS4500 Library 1.1.1.6 - 1.12.0.3. IBM lists no workarounds.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Storage TS4500 Library","fixed":["1.12.0.4"],"affected":">= 1.1.1.6, <= 1.12.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","ibm-storage","infrastructure","tape-library","ts4500"],"not_affected_if":["fixed-firmware","outside-affected-versions"],"how_to_check":"Check the TS4500 library firmware version (management GUI or your IBM service contact). Versions 1.1.1.6 through 1.12.0.3 are listed as affected by IBM. Also review who holds management GUI/REST accounts, and look for unexpected password changes on accounts.","fix":"For the 1.12.0 release, upgrade to firmware 1.12.0.4 Fix Pack or later, from IBM Fix Central. IBM says all future releases include the fix. The bulletin gives no fixed version for other release lines.","status":"open","published_at":"2026-11-08T19:17:38+00:00","first_seen_at":"2026-11-08T19:22:33+00:00","triaged_at":"2026-11-08T19:23:11+00:00","updated_at":"2026-11-08T19:24:59+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-08T19:23:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM TS4500 tape library: authenticated users can take over accounts","impact":"high","summary":"IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 have an improper authorization flaw. A remote attacker with a valid login can take over other user accounts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-storage","ts4500","tape-library"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker takes over other user accounts on the library","analyst_note":"Check the IBM security bulletin for CVE-2026-19133 for a fixed version and exposure details; the NVD entry alone gives only the range.","how_to_check":"- Confirm the installed TS4500 Library version against the affected range `1.1.1.6` through `1.12.0.3`\n- unknown for anything beyond the version range","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Organizations running the IBM Storage TS4500 tape library software within the affected version range. The sources do not say which management interfaces are exposed or which configurations are default. Anyone running a version outside the range can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4529,"output_tokens":488,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-19133 for a fixed version and exposure details; the NVD entry alone gives only the range.","search":"'-19133':23A,26A '-2026':22A,25A '1.1.1.6':85B,95C '1.12.0.3':86B,97C 'access':77B 'account':20A,80B,107C 'affect':81B 'allow':99C 'anoth':12A,71B 'attack':103C 'authent':62B,102C 'author':53B,112C 'bulletin':41B 'chang':11A,56B,70B 'could':64B,98C 'cve':21A,24A 'due':109C 'enforc':52B 'firmwar':30B 'gain':76B 'ibm':1A,32B,39B,87B,91C 'ibm-storag':31B 'improp':111C 'infrastructur':34B 'interfac':49B 'librari':4A,37B,84B,94C 'library':29A 'list':88B 'low':7A 'low-privileg':6A 'lower':60B 'lower-privileg':59B 'password':15A,55B,74B 'perform':105C 'privileg':8A,61B 'remot':101C 'request':57B 'rest':48B 'say':42B 'session':68B 'storag':33B,82B,92C 'storage':27A 'take':17A 'takeov':108C 'tape':3A,36B 'tape-librari':35B 'ts4500':2A,28A,38B,44B,83B,93C 'ui':46B 'unauthor':106C 'use':65B 'user':9A,13A,63B,72B 'web':45B 'workaround':90B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Storage TS4500 Library firmware 1.1.1.6 through 1.12.0.3 whose management Web UI or REST interface is reachable by more than one user. The attacker needs a valid low-privilege login. Teams on firmware 1.12.0.4 or later, or with no TS4500, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T19:24:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7292609","run_id":2217},"products":{"at":"2026-11-08T19:24:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7292609","run_id":2217},"workarounds":{"at":"2026-11-08T19:24:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7292609","run_id":2217},"how_to_check":{"at":"2026-11-08T19:24:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7292609","run_id":2217},"who_affected":{"at":"2026-11-08T19:24:59Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7292609","run_id":2217}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["storagets4500library","ts4500library"],"ptokens":["library","storage","ts4500"],"labels":["firmware","high","ibmstorage","infrastructure","tapelibrary","ts4500"],"campaign_type":null,"search_a":"'-19133':23A,26A '-2026':22A,25A 'account':20A 'anoth':12A 'chang':11A 'cve':21A,24A 'ibm':1A 'librari':4A 'library':29A 'low':7A 'low-privileg':6A 'password':15A 'privileg':8A 'storage':27A 'take':17A 'tape':3A 'ts4500':2A,28A 'user':9A,13A","search_b":"'1.1.1.6':85B '1.12.0.3':86B 'access':77B 'account':80B 'affect':81B 'anoth':71B 'authent':62B 'author':53B 'bulletin':41B 'chang':56B,70B 'could':64B 'enforc':52B 'firmwar':30B 'gain':76B 'ibm':32B,39B,87B 'ibm-storag':31B 'infrastructur':34B 'interfac':49B 'librari':37B,84B 'list':88B 'lower':60B 'lower-privileg':59B 'password':55B,74B 'privileg':61B 'request':57B 'rest':48B 'say':42B 'session':68B 'storag':33B,82B 'tape':36B 'tape-librari':35B 'ts4500':38B,44B,83B 'ui':46B 'use':65B 'user':63B,72B 'web':45B 'workaround':90B","search_c":"'1.1.1.6':95C '1.12.0.3':97C 'account':107C 'allow':99C 'attack':103C 'authent':102C 'author':112C 'could':98C 'due':109C 'ibm':91C 'improp':111C 'librari':94C 'perform':105C 'remot':101C 'storag':92C 'takeov':108C 'ts4500':93C 'unauthor':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19133","severity":null,"published_at":"2026-11-08T19:17:38+00:00","modified_at":"2026-11-08T19:17:38+00:00","first_seen_at":"2026-11-08T19:22:33+00:00","fetched_at":"2026-11-08T19:22:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-19133:2217","url":"https://www.ibm.com/support/pages/node/7292609","severity":null,"published_at":"2026-11-08T19:24:59+00:00","modified_at":"2026-11-08T19:24:59+00:00","first_seen_at":"2026-11-08T19:24:59+00:00","fetched_at":"2026-11-08T19:24:59+00:00","note":"Read IBM bulletin node/7292609 (published 14 Oct 2026): fix 1.12.0.4 for 1.12.0 line, workarounds none. Not exploited per sources. Bulletin text names 'Diamondback' in CVE description but affected table lists only TS4500.","cites":["https://www.ibm.com/support/pages/node/7292609"]}],"documents":[{"id":103202,"url":"https://www.ibm.com/support/pages/node/7292609","title":"IBM Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2026-19133","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}