CVE-2020-4446: IBM Business Automation Workflow

Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days.

IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126.

Affected products

• IBM Business Automation Workflow: from 18.0.0.0, up to and including 18.0.0.2; from 19.0.0.1, up to and including 19.0.0.3
• IBM Business Process Manager: from 8.0.0.0, up to and including 8.0.1.3; from 8.5.0.0, up to and including 8.5.7.0; version 8.6.0.0 only

Published 2020-05-06. Last modified 2026-06-17.