CVE-2025-36262 IBM Planning Analytics Local information disclosure
A privileged user can bypass UI controls to access sensitive information due to improper input validation in IBM Planning Analytics Local.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-36262?
CVE-2025-36262 is a medium-severity vulnerability in IBM Planning Analytics Local, published on 30 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13
could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input.
Weakness: CWE-1286
Which versions are affected by CVE-2025-36262?
It affects 1 product.
Products include Ibm Planning Analytics Local.
How do I fix CVE-2025-36262?
No fix has been published for CVE-2025-36262 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-36262 being exploited?
There is no known exploitation of CVE-2025-36262 in the wild and no public exploit code.
Other vulnerabilities in IBM Planning Analytics Local
- CVE-2025-36357 IBM Planning Analytics Local Directory Traversal
- CVE-2026-10545 IBM Planning Analytics Local is affected by Open Redirect
- CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2024-35143 IBM Planning Analytics Local missing authentication
- CVE-2026-1267 IBM Planning Analytics Information Disclosure
Sources
Also known as GHSA-v2vp-5c9f-vwfc.