CVE-2026-9610 is a CWE-425 Direct Request ('Forced Browsing') vulnerability affecting IBM Datacap and IBM Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9. The vulnerability arises because certain resources or functionalities are accessible via direct URL requests despite not being linked in the UI, allowing users with high privileges to bypass intended access controls. The CVSS 3.1 base score is 2.3, reflecting low impact primarily on confidentiality with no impact on integrity or availability. The vendor has not published any remediation level or patch information. The product is not a cloud service, and no known exploits have been reported.

The vulnerability allows users with high privileges to access hidden or unlinked resources or functionality by directly requesting URLs, potentially leading to limited confidentiality exposure. There is no impact on integrity or availability. The overall impact is low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor IBM's advisories for updates. Until a fix is available, restrict access to high-privilege users and review access controls to minimize exposure to unlinked resources.