IBM Cloud Pak for Business Automation contains a missing authorization vulnerability (CWE-862) identified as CVE-2026-12758. This flaw allows a remote attacker with low privileges to bypass authorization controls and access restricted endpoints by exploiting improper validation of HTTP headers. The vulnerability affects specific versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0. The CVSS v3.1 base score is 5.4, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity impacts are low, with no availability impact.

An attacker with limited privileges can bypass authorization mechanisms and invoke restricted API endpoints, potentially leading to unauthorized access to sensitive functions or data within IBM Cloud Pak for Business Automation. The impact on confidentiality and integrity is low, and there is no impact on availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected versions and monitor for suspicious activity related to unauthorized endpoint access. Follow IBM's security advisories for updates.