IBM Business Automation Workflow containers and traditional versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0 contain a missing authorization vulnerability (CWE-862) that could allow an authenticated attacker with low privileges to trigger restricted import actions. This flaw arises due to insufficient enforcement of authorization controls on import functionality. The vulnerability has a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and limited confidentiality and integrity impact. No known exploits are reported, and the product is not a cloud service.

An authenticated attacker with limited privileges could perform restricted import actions that should normally be protected by authorization controls. This may lead to limited confidentiality and integrity impacts within the affected IBM Business Automation Workflow environments. There is no reported impact on availability. No active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's advisories for updates. In the meantime, restrict access to authenticated users with minimal privileges and review import action permissions carefully to mitigate risk.