CVE-2026-49483: CWE-732: Incorrect Permission Assignment for Critical Resource in codefori vscode-ibmi
Description
CVE-2026-49483 is a high-severity vulnerability in the codefori vscode-ibmi Visual Studio Code extension for IBMi. Versions prior to 3.0.1 improperly assign permissions to IBMi components, allowing local accounts to alter critical programs due to insufficient integrity verification. This can lead to execution of altered programs under the connecting user's account. The issue is fixed in version 3.0.1.
CVSS v4.0
Score 8.9high
Affected software
codefori
vscode-ibmi
pkg:github/codefori/vscode-ibmiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability involves incorrect permission assignment for critical resources in the vscode-ibmi extension before version 3.0.1. The extension accepted IBMi components after only verifying the existence of a procedure without reliably checking component integrity. Components installed with overly broad public permissions allowed local accounts to modify programs such as GETMBRINFO. Because the LONG_COMMENT marker alone does not guarantee integrity, a later connection could execute the altered program under the connecting account. This flaw is addressed by improved integrity checks and permission restrictions in version 3.0.1.
Potential Impact
An attacker with local access can modify critical IBMi programs due to overly permissive component installation. This can lead to execution of maliciously altered programs under the privileges of the connecting user, potentially compromising system integrity and security. The vulnerability has a high CVSS 4.0 score of 8.9, reflecting its significant impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade the vscode-ibmi extension to version 3.0.1 or later, where this issue is fixed. The fix includes proper verification of component integrity and correct permission assignment to prevent unauthorized modification of critical programs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-30T04:17:43.095Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd55c92cdf04f656db38f5
Added to database: 10/12/2026, 21:48:57 UTC
Last enriched: 10/12/2026, 22:03:12 UTC
Last updated: 10/12/2026, 22:08:10 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.