Advisory · CVE-2026-123218
IBM Aspera Faspex authorization bypass grants full administrative privileges
IBM Aspera Faspex 5.0.0 through 5.0.19 lets an authorized user craft a specific message that bypasses user authorization and gains full administrative privileges, rated critical at CVSS 9.8; IBM fixed it in 5.0.19 PL1.
- Vendor
- IBM
- Product
- Aspera Faspex
- Identifier / CWE
- CVE-2026-123218
CWE-863 - Action timing
- Immediate
Explain it like I’m five
Faspex checks your badge at the door but trusts whatever you write on the delivery slip. An ordinary logged-in user can write a slip that says admin and walk straight into the control room.
- 01Authorized user signs in
An attacker with an ordinary authorized Faspex account crafts a specific message.
- 02Authorization check bypassed
The message bypasses the user authorization check that should limit the account to its own permissions.
- 03Full admin gained
The attacker gains full administrative privileges over the Faspex instance.
- 04No extra exploit needed
The flaw is reachable over the network with low complexity and no user interaction.
What happened
IBM disclosed CVE-2026-123218 on November 7, 2026: IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, and no user interaction.
IBM fixed the flaw in Aspera Faspex 5.0.19 PL1, per the vendor bulletin, which lists versions 5.0.0 through 5.0.19 as affected and states there are no workarounds or mitigations. Any authenticated account is a starting point, so the exposure is every Faspex user, not just administrators.
What to do
- Inventory IBM Aspera Faspex deployments and record each version.
- Upgrade to Aspera Faspex 5.0.19 PL1 or later, following the fix instructions in IBM’s bulletin.
- Until upgraded, audit Faspex accounts and restrict which users hold accounts at all.
- Review Faspex logs for unusual messages and for privilege changes or administrative actions by ordinary accounts.
- Investigate any account whose privileges changed unexpectedly and revoke admin rights that cannot be accounted for.
- Verify the deployed version and the faspex-core container image after updating.
Management note
The barrier here is only an account, and Faspex accounts are handed out to business users who need to move files. Patch first, then check whether any ordinary account acted like an admin while the window was open.