IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.3) contains a privilege escalation issue (CVE-2025-14915). In plain terms, if a privileged user can access a Liberty instance with a specific feature enabled (restConnector-1.0 or restConnector-2.0), they may be able to gain additional access to the application server.
The IBM advisory indicates the vulnerability is tied to the Liberty “restConnector-1.0” or “restConnector-2.0” feature being enabled. The root cause is described at a high level as a privilege escalation condition, and the advisory associates the issue with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), but the provided reference content does not include deeper implementation details such as specific classes, functions, or request handlers. The attack vector is network-based (AV:N), and exploitation requires a privileged user (PR:H), with no user interaction (UI:N). The advisory does not provide a PoC or exploit workflow in the supplied content.
Impact-wise, the vulnerability is rated medium with CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). This indicates an attacker who already has some level of privilege could escalate to obtain higher-impact access within the application server context, leading to high confidentiality and integrity impact (C:H, I:H) while availability is not indicated as affected (A:N). The blast radius is limited to Liberty instances running the affected versions and with restConnector-1.0 or restConnector-2.0 enabled; the advisory does not mention cross-component or system-wide compromise beyond “additional access to the application server.”
Mitigation: IBM recommends addressing the issue immediately by applying an interim fix or fix pack that includes the fix for APAR PH70327. For Liberty 17.0.0.3 through 26.0.0.3 with restConnector-1.0 or restConnector-2.0 enabled, IBM’s guidance is either (1) upgrade to the minimal fix pack levels required by the interim fix and then apply the Interim Fix that resolves PH70327, or (2) apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026). No workarounds or mitigations are listed in the provided reference content. Detection guidance from the reference content is limited to verifying whether the restConnector feature is enabled (IBM points to “How to determine if Liberty is using a specific feature”).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CWE-200