# CVE-2026-9610: IBM Datacap forced browsing access control bypass

Source: https://junglewise.ai/threats/cve-2026-9610-ibm-datacap-forced-browsing-access-control-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-9610 · Severity: low · CVSS 2.3 · Published 2026-06-22

IBM Datacap, a document capture and data extraction platform, contains a security flaw where certain administrative or internal functions are not properly hidden. An authorized user with high-level system access could bypass the standard user interface to access restricted resources by manually entering specific web addresses. While the risk is low because it requires existing high-level permissions, it could lead to unauthorized viewing of system information.

Technologies: [IBM Datacap](https://junglewise.ai/threats/technologies/datacap), [IBM Datacap Navigator](https://junglewise.ai/threats/technologies/datacap-navigator). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-9610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9610 being exploited in the wild.

**How severe is CVE-2026-9610?** Low severity, with a CVSS score of 2.3, published 22 June 2026.

**Which products and versions are affected?** IBM Datacap 9.1.7, 9.1.8, 9.1.9; IBM Datacap Navigator 9.1.7, 9.1.8, 9.1.9.

**Is there a fix for CVE-2026-9610?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9610 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-9610?** Check whether you run IBM Datacap or IBM Datacap Navigator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A direct request (forced browsing) vulnerability exists in IBM Datacap and Datacap Navigator (CWE-425). The application fails to properly enforce access controls on certain resources or functionalities that are omitted from the standard UI navigation. An attacker with high-privileged local access (PR:H) can bypass intended UI restrictions by manually crafting and requesting specific URLs. This could allow the attacker to view sensitive system resources or metadata. The vulnerability is addressed in IBM Datacap version 9.1.9 Interim Fix 008.

## Affected products

- IBM Datacap 9.1.7, 9.1.8, 9.1.9
- IBM Datacap Navigator 9.1.7, 9.1.8, 9.1.9

## Timeline

- 2026-06-16: advisory: Initial publication by IBM
- 2026-06-22: disclosed: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7276609](https://www.ibm.com/support/pages/node/7276609)

## Related threats

- [IBM Datacap sensitive information disclosure in memory](https://junglewise.ai/threats/cve-2026-8636-ibm-datacap-sensitive-information-disclosure-in-memory)
- [IBM Datacap cross-site scripting in Navigator Web UI](https://junglewise.ai/threats/cve-2026-8059-ibm-datacap-cross-site-scripting-in-navigator-web-ui)