CVE-2025-36327 affects IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The vulnerability arises because security controls intended to be enforced on the server side are instead enforced on the client side, allowing an authenticated user to bypass these controls and carry out unauthorized actions. This represents a weakness in the security design where client-side enforcement can be manipulated, violating the principle that security must be enforced on the server side.

An authenticated user can bypass intended security controls and perform unauthorized actions within the affected versions of IBM watsonx.data intelligence. This could lead to unauthorized modification or manipulation of data or system functions, impacting the integrity of the system. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

No official patch or remediation guidance has been published by IBM at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to trusted users only and monitor for unusual activity related to authorization bypass. Avoid relying on client-side enforcement for critical security controls.