Cross-Site Request Forgery Vulnerability in IBM Concert Z Hub Component
CVE-2025-36018

6.5MEDIUM

Key Information:

Vendor

IBM
Status
Concert
Vendor
CVE Published:
17 February 2026

What is CVE-2025-36018?

IBM Concert versions 1.0.0 through 2.1.0 for the Z hub component is susceptible to cross-site request forgery. This vulnerability may allow an attacker to carry out unapproved actions by exploiting the trust of an authenticated user on the website. If successfully executed, this could lead to unauthorized access or actions being performed within the application, putting sensitive information and system integrity at risk.

Affected Version(s)

Concert 1.0.0 <= 2.1.0

References

https://www.ibm.com/support/pages/node/7260162
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.