{"id":"CVE-2026-4405","kind":"vulnerability","aliases":["CVE-2026-4405"],"related":[],"title":"IBM Concert: cached web pages readable by other local users","description":"IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.","summary":"IBM Concert versions 1.0 through 3.0.0 store web page content in a local cache. Another user on the same machine can read that cached content.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-concert","self-hosted","shared-workstation","vendor"],"not_affected_if":["single-user-machine","unaffected-version"],"how_to_check":"- Confirm whether IBM Concert is installed and which version is running, against the affected range `1.0` through `3.0.0`\n- unknown","fix":"- Move to an IBM Concert release newer than `3.0.0` as published in the IBM advisory\n- unknown","status":"open","published_at":"2026-10-19T18:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:41:57+00:00","updated_at":"2026-10-25T04:41:57+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:41:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move to an IBM Concert release newer than `3.0.0` as published in the IBM advisory\n- unknown","reach":"local","title":"IBM Concert: cached web pages readable by other local users","impact":"low","summary":"IBM Concert versions 1.0 through 3.0.0 store web page content in a local cache. Another user on the same machine can read that cached content.","category":"vendor","nicknames":[],"who_cares":["ibm-concert","self-hosted","shared-workstation"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Another local user reads cached web page content","analyst_note":"Find the IBM security bulletin for CVE-2026-4405 to confirm the affected cache path, the fixed version and what data the cached pages contain.","how_to_check":"- Confirm whether IBM Concert is installed and which version is running, against the affected range `1.0` through `3.0.0`\n- unknown","needs_analyst":true,"not_affected_if":["single-user-machine","unaffected-version"],"who_is_affected":"Teams running IBM Concert in the affected version range on shared hosts or workstations where more than one local user has access. The sources do not say which cache location or configuration is involved, so the exposure on a single-user machine is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000563,"input_tokens":3263,"output_tokens":474,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-4405':13A,16A '1.0':30B,54C '3.0.0':32B,56C 'allow':57C 'anoth':41B,70C 'cach':3A,40B,50B,60C 'concert':2A,19B,28B,53C 'content':36B,51B 'cve':11A,14A 'host':22B 'ibm':1A,18B,27B,52C 'ibm-concert':17B 'local':9A,39B,64C 'machin':46B 'page':5A,35B,59C 'read':48B,68C 'readabl':6A 'self':21B 'self-host':20B 'share':24B 'shared-workst':23B 'store':33B,63C 'system':74C 'user':10A,42B,71C 'vendor':26B 'version':29B 'web':4A,34B,58C 'workstat':25B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Concert in the affected version range on shared hosts or workstations where more than one local user has access. The sources do not say which cache location or configuration is involved, so the exposure on a single-user machine is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-4405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4405","severity":null,"published_at":"2026-10-19T18:17:07+00:00","modified_at":"2026-10-19T20:55:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}