{"id":"CVE-2026-19307","kind":"vulnerability","aliases":["CVE-2026-19307"],"related":[],"title":"IBM Sterling B2B Integrator: authenticated users can reach unauthorized pages","description":"IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to access unauthorized pages due to improper authorization.","summary":"IBM Sterling B2B Integrator and Sterling File Gateway versions 6.2.1.0 through 6.2.2.1_1 have an improper authorization flaw. A remote attacker with a valid account can open pages they should not be allowed to see.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["b2b-integrator","file-gateway","ibm-sterling","other","self-hosted"],"not_affected_if":["other-versions","unauthenticated-only-access"],"how_to_check":"- Check the installed Sterling B2B Integrator or File Gateway version against the affected ranges in the IBM advisory","fix":"- Move to a release newer than 6.2.1.2_1 or 6.2.2.1_1, per the IBM advisory (exact fixed version unknown)","status":"open","published_at":"2026-11-08T19:17:38+00:00","first_seen_at":"2026-11-08T19:22:33+00:00","triaged_at":"2026-11-08T19:23:35+00:00","updated_at":"2026-11-08T19:23:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-08T19:23:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than 6.2.1.2_1 or 6.2.2.1_1, per the IBM advisory (exact fixed version unknown)","reach":"network","title":"IBM Sterling B2B Integrator: authenticated users can reach unauthorized pages","impact":"medium","summary":"IBM Sterling B2B Integrator and Sterling File Gateway versions 6.2.1.0 through 6.2.2.1_1 have an improper authorization flaw. A remote attacker with a valid account can open pages they should not be allowed to see.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ibm-sterling","b2b-integrator","file-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads pages and data they lack rights to","analyst_note":"Confirm the fixed versions and any workaround in the IBM security bulletin for Sterling B2B Integrator and File Gateway; the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed Sterling B2B Integrator or File Gateway version against the affected ranges in the IBM advisory\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","other-versions"],"who_is_affected":"Organizations running IBM Sterling B2B Integrator or IBM Sterling File Gateway Standard Edition in the listed 6.2.1.x and 6.2.2.x ranges. The attacker needs an authenticated account on the application. Deployments without a valid login path for untrusted users are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000785,"input_tokens":4636,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-19307':13A,16A '-2026':12A,15A '1':42B,72C,77C,86C,91C '6.2.1.0':39B,69C,83C '6.2.1.2':71C,85C '6.2.2.0':74C,88C '6.2.2.1':41B,76C,90C 'access':101C 'account':54B 'allow':62B,95C 'attack':50B,99C 'authent':5A,98C 'author':46B,107C 'b2b':3A,18B,32B,67C 'b2b-integrator':17B 'could':94C 'cve':11A,14A 'due':104C 'edit':93C 'file':21B,36B,81C 'file-gateway':20B 'flaw':47B 'gateway':22B,37B,82C 'host':29B 'ibm':1A,24B,30B,65C,79C 'ibm-sterl':23B 'improp':45B,106C 'integr':4A,19B,33B,68C 'open':56B 'page':10A,57B,103C 'reach':8A 'remot':49B,97C 'see':64B 'self':28B 'self-host':27B 'standard':92C 'sterl':2A,25B,31B,35B,66C,80C 'unauthor':9A,102C 'user':6A 'valid':53B 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Sterling B2B Integrator or IBM Sterling File Gateway Standard Edition in the listed 6.2.1.x and 6.2.2.x ranges. The attacker needs an authenticated account on the application. Deployments without a valid login path for untrusted users are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["b2bintegrator","filegateway","ibmsterling","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-19307':13A,16A '-2026':12A,15A 'authent':5A 'b2b':3A 'cve':11A,14A 'ibm':1A 'integr':4A 'page':10A 'reach':8A 'sterl':2A 'unauthor':9A 'user':6A","search_b":"'1':42B '6.2.1.0':39B '6.2.2.1':41B 'account':54B 'allow':62B 'attack':50B 'author':46B 'b2b':18B,32B 'b2b-integrator':17B 'file':21B,36B 'file-gateway':20B 'flaw':47B 'gateway':22B,37B 'host':29B 'ibm':24B,30B 'ibm-sterl':23B 'improp':45B 'integr':19B,33B 'open':56B 'page':57B 'remot':49B 'see':64B 'self':28B 'self-host':27B 'sterl':25B,31B,35B 'valid':53B 'version':38B","search_c":"'1':72C,77C,86C,91C '6.2.1.0':69C,83C '6.2.1.2':71C,85C '6.2.2.0':74C,88C '6.2.2.1':76C,90C 'access':101C 'allow':95C 'attack':99C 'authent':98C 'author':107C 'b2b':67C 'could':94C 'due':104C 'edit':93C 'file':81C 'gateway':82C 'ibm':65C,79C 'improp':106C 'integr':68C 'page':103C 'remot':97C 'standard':92C 'sterl':66C,80C 'unauthor':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19307","severity":null,"published_at":"2026-11-08T19:17:38+00:00","modified_at":"2026-11-08T19:17:38+00:00","first_seen_at":"2026-11-08T19:22:33+00:00","fetched_at":"2026-11-08T19:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}