CVE-2026-12758 describes an authorization bypass vulnerability in IBM Cloud Pak for Business Automation. The flaw arises from improper validation of HTTP headers, which could allow a remote attacker with low privileges to access restricted endpoints that should otherwise be protected. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. No specific affected versions or patches are documented in the provided information.

An attacker with some privileges could bypass authorization checks and invoke restricted endpoints, potentially leading to unauthorized access to sensitive information or modification of data. The impact affects confidentiality and integrity but does not affect availability. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual access patterns and restrict privileges where possible. Follow vendor instructions once published.