CVE-2023-47716 is an incorrect authorization flaw in the Content Platform Engine of IBM FileNet Content Manager and the CP4BA FileNet component. NVD scores it 6.3, Medium. A user could gain the privileges of another user under unusual circumstances. IBM lists an interim fix for each version.
What's affected
IBM's bulletin lists these affected products and their fixes:
- FileNet Content Manager 5.5.8.0: 5.5.8.0-P8CPE-IF006, dated 28 February 2024.
- FileNet Content Manager 5.5.10.0: 5.5.10.0-P8CPE-IF002, dated 26 January 2024.
- FileNet Content Manager 5.5.11.0: 5.5.11.0-P8CPE-IF002, dated 25 July 2024.
- CP4BA FileNet Content Manager 21.0.3: CP4BA-21.0.3-IF28, dated 27 December 2023.
- CP4BA FileNet Content Manager 23.0.1: CP4BA-23.0.1-IF6, dated 27 December 2023.
All fixes are tracked under APAR PJ47208. IBM lists no workarounds.
The weakness is CWE-863, incorrect authorization. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and IBM's bulletin gives the same 6.3 in CVSS 3.0 form. No conflict on severity. The record's date of 1 March 2024 predates the 5.5.11.0 fix of July 2024, so version 5.5.11.0 owners had to wait for the later interim fix.
How to check if you're exposed
Find the version of the Content Platform Engine in the FileNet administration tools. Then list the interim fixes that are installed, using the product's own fix history, and compare with the table above.
The description says the issue appears under unusual circumstances, and IBM does not explain what they are. Because of that, you cannot rule out exposure by looking at how you use the product. Treat every affected version as exposed until the interim fix is in place.
What to do now
- Install the interim fix for your version from the list above, using IBM's instructions for APAR PJ47208.
- For the 5.5.11.0 line, confirm you installed IF002 dated 25 July 2024 or later.
- Review which users hold elevated roles in the object stores, and remove rights that are not needed.
- Review audit records for actions that do not match the user who took them.
- Add the product and its fix level to your system inventory.
Why it matters
Incorrect authorization, CWE-863, is a check that is performed but gives the wrong answer. Unlike a missing check, the code looks right on a quick read. The result here, per IBM, is that one user can end up holding the privileges of another.
For a content and records platform, that matters in two ways. It can expose documents the user should not see, and it can attribute actions to the wrong person in the audit trail. Both are problems for any team that relies on the platform for regulated records.
The score of 6.3 reflects a Low rating on each of confidentiality, integrity and availability, and the requirement for a valid account. It is a moderate score for a flaw that sits in the heart of access control, so read it together with the sensitivity of what the platform holds.
Quick check
Which fix applies to FileNet 5.5.11.0?
IBM lists 5.5.11.0-P8CPE-IF002, dated 25 July 2024.
What are the unusual circumstances?
IBM does not say. The bulletin states only that a user could gain another user's privileges in specific cases.
Sources
- IBM security bulletin for FileNet Content Manager
- IBM X-Force entry 271656
- Safeguard Gold page for CVE-2023-47716
Last reviewed: 19 October 2026.
