CVE-2026-4405: IBM Concert local web cache accessible to other users

CVE-2026-4405 · Severity: medium · CVSS 4 · Published 2026-10-19

IBM Concert is an application platform that caches web pages locally. In versions 1.0 through 3.0.0, cached files are stored with overly permissive access controls, allowing another user on the same system to read sensitive cached content including authentication tokens, personal data, and application state. An attacker with local system access can retrieve and exploit this cached information.

Technologies: IBM Concert. Vendors: IBM.

Quick answers

Is CVE-2026-4405 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4405 being exploited in the wild.
How severe is CVE-2026-4405?
Medium severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?
IBM Concert 1.0 through 3.0.0.
Is there a fix for CVE-2026-4405?
Yes: fixed in Concert 3.0.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4405 attacked?
It is attacked with local access, in a web application.
Am I affected by CVE-2026-4405?
Check whether you run IBM Concert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Concert 3.0.1.1

Technical details

IBM Concert stores web page cache on the local filesystem without restricting file permissions, allowing unauthorized local file access (CWE-276). This is a local privilege escalation requiring system-level access; the cached content may include sensitive data intended only for the original user. A fix is available in version 3.0.1.1.

Affected products

  • IBM Concert 1.0 through 3.0.0

Timeline

  • 2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.