CVE-2014-6139: IBM Business Process Manager

Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days.

The Search REST API in IBM Business Process Manager 8.0.1.3, 8.5.0.1, and 8.5.5.0 allows remote authenticated users to bypass intended access restrictions and perform task-instance and process-instance searches by specifying a false value for the filterByCurrentUser parameter.

Affected products

• IBM Business Process Manager: version 8.0.1.3 only; version 8.5.0.1 only; version 8.5.5.0 only

Published 2015-02-13. Last modified 2026-06-17.