CVE-2025-27368 IBM OpenPages Information Disclosure
An authenticated user can access unauthorized system metadata via REST endpoints, leading to sensitive information disclosure in IBM OpenPages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27368?
CVE-2025-27368 is a medium-severity vulnerability in IBM OpenPages, published on 12 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond what the user is intended to view.
Weakness: CWE-497
Which versions are affected by CVE-2025-27368?
It affects 1 product.
Products include Ibm Openpages.
How do I fix CVE-2025-27368?
No fix has been published for CVE-2025-27368 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27368 being exploited?
There is no known exploitation of CVE-2025-27368 in the wild and no public exploit code.
Other vulnerabilities in IBM OpenPages
- CVE-2025-36223 IBM OpenPages Host Header Injection
- CVE-2025-33110 IBM OpenPages Vulnerable to HTML Injection
- CVE-2025-36121 HTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages Application
- CVE-2025-2670 IBM OpenPages information disclosure
- CVE-2025-36082 IBM OpenPages information disclosure
Sources
Also known as GHSA-jgg9-j8gm-7w7m.