CVE-2025-36157 IBM Engineering Lifecycle Management incorrect authorization

What is CVE-2025-36157?

CVE-2025-36157 is a critical missing authorization vulnerability in IBM Engineering Lifecycle Management, published on 24 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.

Weakness: CWE-863

Which versions are affected by CVE-2025-36157?

It affects 1 product.

Products include Ibm Jazz Foundation.

How do I fix CVE-2025-36157?

No fix has been published for CVE-2025-36157 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-36157 being exploited?

There is no known exploitation of CVE-2025-36157 in the wild and no public exploit code.

Other vulnerabilities in IBM Engineering Lifecycle Management

• CVE-2025-25048 IBM Jazz Foundation path traversal Medium 6.5
• CVE-2024-43184 IBM Jazz Foundation cross-site scripting Medium 6.1
• CVE-2023-45181 IBM Jazz Foundation cross-site scripting Medium 6.1
• CVE-2025-1826 IBM Jazz Foundation cross-site scripting Medium 5.4
• CVE-2021-29669 IBM Jazz Foundation cross-site scripting Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7hxx-86w9-pq4x.