CVE-2026-3303: CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains in IBM Concert

CVE-2026-3303 describes a vulnerability in IBM Concert versions 1.0 through 3.0.0 where the cross-origin resource sharing (CORS) policy is configured permissively, allowing untrusted domains to interact with the application. This permissive CORS policy (CWE-942) could enable attackers to carry out privileged actions by leveraging the lack of domain restrictions in CORS, potentially leading to unauthorized access or actions within the application context. The vulnerability has a CVSS 3.1 base score of 3.7, reflecting low severity due to network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows attackers from remote networks to potentially perform privileged actions without authentication due to the permissive CORS policy. However, the impact is limited to confidentiality loss with no integrity or availability impact, and the attack complexity is high, reducing the likelihood of exploitation.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to review and restrict the CORS policy to only allow trusted domains to prevent unauthorized cross-origin requests.