CVE-2025-36327 affects IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The vulnerability arises because security controls intended to be enforced on the server side are instead enforced on the client side, allowing an authenticated user to bypass these controls and perform unauthorized actions. This is a classic case of CWE-602: Client-Side Enforcement of Server-Side Security. The CVSS 3.1 base score is 6.5, reflecting a medium severity impact primarily due to the ability to perform unauthorized actions without impacting confidentiality or availability. The vulnerability requires low attack complexity and privileges, with no user interaction needed. No official fix or patch has been published by IBM as of the data available.

An authenticated user can bypass intended server-side security controls by exploiting client-side enforcement, enabling unauthorized actions within IBM watsonx.data intelligence. This could lead to unauthorized modification or manipulation of data or functionality. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, organizations should review and restrict authenticated user privileges to minimize potential unauthorized actions. Monitor IBM advisories for updates on patches or official mitigations.