{"id":"CVE-2026-3303","kind":"vulnerability","aliases":["CVE-2026-3303"],"related":[],"title":"IBM Concert: permissive CORS lets outside sites act as users","description":"IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.","summary":"IBM Concert versions 1.0 through 3.0.0 accept cross-origin requests from domains that are not on a trusted list. A malicious web page could make a logged-in user's browser perform privileged actions in Concert.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-concert","self-hosted","vendor"],"not_affected_if":["not-ibm-concert","patched-version"],"how_to_check":"- Confirm whether your team runs IBM Concert and which version is deployed, using the product's about or version page.\n- unknown","fix":"- Move IBM Concert to a release later than `3.0.0`, as listed in the IBM advisory.\n- unknown","status":"open","published_at":"2026-10-19T18:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:44:04+00:00","updated_at":"2026-10-25T04:44:04+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:44:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move IBM Concert to a release later than `3.0.0`, as listed in the IBM advisory.\n- unknown","reach":"internet","title":"IBM Concert: permissive CORS lets outside sites act as users","impact":"medium","summary":"IBM Concert versions 1.0 through 3.0.0 accept cross-origin requests from domains that are not on a trusted list. A malicious web page could make a logged-in user's browser perform privileged actions in Concert.","category":"vendor","nicknames":[],"who_cares":["ibm-concert","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker performs privileged Concert actions as a logged-in user","analyst_note":"Find the IBM security bulletin for CVE-2026-3303 to confirm the fixed version and the exact CORS scope.","how_to_check":"- Confirm whether your team runs IBM Concert and which version is deployed, using the product's about or version page.\n- unknown","needs_analyst":true,"not_affected_if":["not-ibm-concert","patched-version"],"who_is_affected":"Teams running IBM Concert versions 1.0 through 3.0.0 where a logged-in user could visit an untrusted site in the same browser. The sources do not say which deployment setups are exposed. Teams not running IBM Concert in that version range can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000584,"input_tokens":3299,"output_tokens":508,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-3303':13A,16A '1.0':27B,64C '3.0.0':29B,66C 'accept':30B 'act':8A 'action':59B,83C 'allow':76C 'attack':78C 'browser':56B 'carri':80C 'concert':2A,19B,25B,61B,63C 'cor':4A,73C 'could':48B,75C 'cross':32B,69C 'cross-origin':31B,68C 'cve':11A,14A 'domain':36B,86C,95C 'host':22B 'ibm':1A,18B,24B,62C 'ibm-concert':17B 'let':5A 'limit':91C 'list':43B 'log':52B 'logged-in':51B 'make':49B 'malici':45B 'name':87C 'origin':33B,70C 'outsid':6A 'page':47B 'perform':57B 'permiss':3A 'privileg':58B,82C 'request':34B 'resourc':71C 'self':21B 'self-host':20B 'share':72C 'site':7A 'trust':42B,94C 'use':67C 'user':10A,54B 'vendor':23B 'version':26B 'web':46B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Concert versions 1.0 through 3.0.0 where a logged-in user could visit an untrusted site in the same browser. The sources do not say which deployment setups are exposed. Teams not running IBM Concert in that version range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-3303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3303","severity":null,"published_at":"2026-10-19T18:17:07+00:00","modified_at":"2026-10-20T17:17:39+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}