Description

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T20:17:13.773Z",
  "pubdate": "2026-08-13T20:17:13.773Z",
  "executiveSummary": "A cross-site request forgery vulnerability has been identified in IBM Planning Analytics 2.0 and 2.1 Local. This security flaw allows an unauthenticated remote attacker to trick an authenticated user into executing unintended, malicious, and unauthorized actions within the context of the victim's active session. The primary impact of this vulnerability involves the potential compromise of application integrity and unauthorized state manipulation, depending on the privileges held by the targeted user. The risk implication is significant within enterprise environments where administrative or sensitive financial planning workflows are hosted, as successful exploitation bypasses implicit session trust. The attacker capabilities rely on social engineering techniques, such as inducing the victim to visit a malicious website or click a crafted hyperlink, which subsequently transmits forged HTTP requests containing session cookies or other automatic authentication tokens directly to the vulnerable IBM Planning Analytics deployment. Exploitation strictly requires the targeted user to be authenticated and interacting with the application concurrently via a vulnerable web browser context.",
  "technicalDetails": "The vulnerability stems from an insufficient validation or complete absence of unpredictable anti-CSRF tokens, such as Synchronizer Tokens, within HTTP state-changing requests processed by the vulnerable web application components of IBM Planning Analytics 2.0 and 2.1 Local. Because web browsers automatically attach session identifiers—including HTTP cookies and HTTP Authentication headers—to cross-origin requests directed at a target domain, the application cannot inherently differentiate between a legitimate user-initiated action and a forged request initiated by a third-party domain under the control of an attacker.\nThe exploitation method involves the attacker constructing a malicious HTML page or script hosted on an external infrastructure. This payload contains automated triggers, such as hidden HTML form elements, JavaScript Fetch APIs, or standard image and iframe tags designed to issue unauthorized HTTP POST, PUT, or DELETE requests to the vulnerable IBM Planning Analytics server endpoints. When an authenticated user accesses the attacker-controlled resource while maintaining an active session with the IBM Planning Analytics environment, the browser automatically dispatches the forged requests along with the valid session credentials.\nThe attack flow proceeds as follows: First, the victim establishes a valid authenticated session with IBM Planning Analytics 2.0 or 2.1 Local. Second, the attacker lures the victim to a malicious external website using phishing or social engineering. Third, the browser renders the malicious page, executing the hidden scripts that automatically submit fraudulent transaction or configuration modification requests to the target application. Fourth, the application server processes the incoming request, trusting the accompanying session cookies, and executes the unauthorized actions on behalf of the victim without their explicit knowledge or consent. Network exposure is primarily via HTTP/HTTPS interfaces accessible to the users. Privilege requirements are dictated by the victim's active role within the application, and payload behavior focuses on executing state-changing operations to compromise confidentiality, integrity, or availability."
}