CVE-2023-46186 is a medium severity (CVSS 5.3) improper access control flaw in IBM Jazz for Service Management 1.1.3.20. An unauthorized user can use forced browsing to obtain sensitive file information. IBM recommends installing JazzSM 1.1.3.20 iFix-0001 and lists no workarounds.
What's affected
The record and the IBM bulletin both name Jazz for Service Management 1.1.3.20. The bulletin lists AIX, Windows and Linux as the platforms. It does not name a separate fixed release. Its remediation is the interim fix JazzSM 1.1.3.20 iFix-0001, applied on top of 1.1.3.20.
IBM scores the issue 5.3 with a CVSS v3.0 vector that matches the record. IBM lists no workarounds or mitigations. IBM published the bulletin on 13 February 2024.
The NVD record scores it 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The weakness class is CWE-425 (direct request (forced browsing)). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the installed Jazz for Service Management version from the product's version information or your installation manager. If it shows 1.1.3.20 and the iFix is not listed, you are exposed. IBM Installation Manager lists installed fixes for the package.
It is also worth asking whether the Jazz console is reachable from outside your management network.
What to do now
- Confirm the Jazz for Service Management version on each server.
- Download and install JazzSM 1.1.3.20 iFix-0001 following IBM's instructions.
- Limit access to the Jazz web interface to the networks that need it.
- Review web access logs for requests that probe for files outside normal navigation.
- Update your inventory with the patch level.
Why it matters
Forced browsing means requesting paths the application never links to and finding that it serves them anyway. The record maps this to CWE-425, the direct request class. The fix is to enforce access checks on every route, not only on the pages that appear in menus.
The impact is limited to some confidentiality loss, which explains the medium rating. File names and contents can still help an attacker plan the next step, so the iFix is worth applying.
Quick check
Is there a mitigation if I cannot patch now?
IBM lists none. Limiting network access to the console reduces exposure but is not a fix.
Does it change data?
No. The vector shows a confidentiality impact only.
Sources
Last reviewed: 19 October 2026.
