CVE-2023-38263 is a medium severity (CVSS 6.5) improper access control flaw in the IBM SOAR QRadar Plugin App. An authenticated user can perform unauthorized actions. It affects versions 1.0 through 5.0.3, and IBM's bulletin says to update the app to version 5.3.1.
What's affected
The affected product is the IBM SOAR QRadar Plugin App, versions 1.0 through 5.0.3. The weakness is improper access control, which lets an authenticated user perform actions they should not. The record is dated 2024-02-02 and scores 6.5, Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the impact is on integrity rather than confidentiality or availability.
IBM's security bulletin gives the same 6.5 score using CVSS 3.0 and lists no workarounds or mitigations. Its remediation is to update to version 5.3.1. The bulletin also covers another CVE that IBM rates higher, so read the whole bulletin rather than only this entry. The IBM X-Force ID is 260577.
Weakness class: CWE-284.
How to check if you're exposed
Check the installed version of the plugin in IBM Security QRadar SOAR, in the app listing for the QRadar plugin. Compare it with the fixed version of 5.3.1.
If you have a scripted inventory of apps, list the QRadar Plugin App version across all your SOAR instances and flag any below 5.3.1. Also review which accounts can use the plugin, since the flaw requires an authenticated user.
What to do now
- Find every SOAR instance that has the QRadar Plugin App installed and note its version.
- Update the app to 5.3.1 or later as IBM's bulletin directs.
- Read the full bulletin for the other CVE it covers and act on it in the same change.
- Review the accounts that can invoke the plugin and remove access that is not needed.
- Check the audit trail for unexpected changes made through the plugin.
Why it matters
Improper access control is a broad class, and here the impact is on integrity. An authenticated user can make changes the product should not allow. In a security orchestration tool that can mean altering incidents, cases or integration behaviour, which makes the audit trail less reliable.
The risk is bounded by the need to log in, so the first control is to know who has accounts. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the IBM bulletin does not report exploitation. Medium severity items like this are easy to defer, so tie the update to the same window as the higher severity item in the bulletin.
Improper access control is a broad class. It covers any case where the product does not correctly restrict who can perform an action or read a resource. The remedy is the same each time: decide the permission each action needs, enforce it on the server for every request, and test that lower roles are refused.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What version fixes this?
IBM's bulletin says update to version 5.3.1.
Is there a workaround?
IBM lists none, so the update is the fix.
Sources
Last reviewed: 19 October 2026.
