{"id":"CVE-2026-93005","kind":"vulnerability","aliases":["CVE-2026-93005"],"related":[],"title":"IBM Process Mining: missing email rate limits let users flood recipients","description":"IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.","summary":"IBM Process Mining versions 2.0.0 through 2.2.1 do not rate-limit email notifications. An authenticated user can make the product send large numbers of emails to chosen recipients, a denial of service against those inboxes.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-notifications","ibm-process-mining","vendor"],"not_affected_if":["outside-affected-range","unauthenticated-only"],"how_to_check":"- Check the installed Process Mining version against the affected range 2.0.0 through 2.2.1","fix":null,"status":"open","published_at":"2026-11-08T19:17:43+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","triaged_at":"2026-11-08T19:23:15+00:00","updated_at":"2026-11-08T19:23:15+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T19:23:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Process Mining: missing email rate limits let users flood recipients","impact":"low","summary":"IBM Process Mining versions 2.0.0 through 2.2.1 do not rate-limit email notifications. An authenticated user can make the product send large numbers of emails to chosen recipients, a denial of service against those inboxes.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-process-mining","email-notifications"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user floods recipients with excessive notification emails","analyst_note":"Confirm the vendor fix version and any workaround from IBM's security bulletin for CVE-2026-93005.","how_to_check":"- Check the installed Process Mining version against the affected range 2.0.0 through 2.2.1\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unauthenticated-only","outside-affected-range"],"who_is_affected":"Organisations running IBM Process Mining in the affected range 2.0.0 through 2.2.1 where users can log in. The flaw needs an authenticated account and affects email notifications sent by the product. Deployments outside that range can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4538,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93005':14A,17A '2.0.0':30B,65C '2.2.1':32B,67C 'allow':69C 'attack':72C 'authent':41B,71C 'caus':74C 'chosen':53B 'could':68C 'cve':12A,15A 'denial':56B,76C 'email':5A,19B,38B,51B,84C,89C 'email-notif':18B 'excess':88C 'flood':10A 'ibm':1A,22B,26B,62C 'ibm-process-min':21B 'inbox':61B 'insuffici':80C 'larg':48B 'let':8A 'limit':7A,37B,82C 'make':44B 'mine':3A,24B,28B,64C 'miss':4A 'notif':20B,39B,85C 'number':49B 'process':2A,23B,27B,63C 'product':46B 'rate':6A,36B,81C 'rate-limit':35B 'recipi':11A,54B,94C 'result':86C 'send':47B 'sent':91C 'servic':58B,78C 'target':93C 'user':9A,42B 'vendor':25B 'version':29B","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM Process Mining in the affected range 2.0.0 through 2.2.1 where users can log in. The flaw needs an authenticated account and affects email notifications sent by the product. Deployments outside that range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailnotifications","ibmprocessmining","medium","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-93005':14A,17A 'cve':12A,15A 'email':5A 'flood':10A 'ibm':1A 'let':8A 'limit':7A 'mine':3A 'miss':4A 'process':2A 'rate':6A 'recipi':11A 'user':9A","search_b":"'2.0.0':30B '2.2.1':32B 'authent':41B 'chosen':53B 'denial':56B 'email':19B,38B,51B 'email-notif':18B 'ibm':22B,26B 'ibm-process-min':21B 'inbox':61B 'larg':48B 'limit':37B 'make':44B 'mine':24B,28B 'notif':20B,39B 'number':49B 'process':23B,27B 'product':46B 'rate':36B 'rate-limit':35B 'recipi':54B 'send':47B 'servic':58B 'user':42B 'vendor':25B 'version':29B","search_c":"'2.0.0':65C '2.2.1':67C 'allow':69C 'attack':72C 'authent':71C 'caus':74C 'could':68C 'denial':76C 'email':84C,89C 'excess':88C 'ibm':62C 'insuffici':80C 'limit':82C 'mine':64C 'notif':85C 'process':63C 'rate':81C 'recipi':94C 'result':86C 'sent':91C 'servic':78C 'target':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93005","severity":null,"published_at":"2026-11-08T19:17:43+00:00","modified_at":"2026-11-08T19:17:43+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","fetched_at":"2026-11-08T19:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}