CVE-2026-13365

CSRF in IBM Planning Analytics isn't a case of developers ignoring known protections—it's a retrofit problem in enterprise software where authentication was layered onto architecture that predates modern CSRF defenses. The CVSS 6.5 score materially understates the actual risk: this application holds budget allocations, revenue forecasts, and workforce planning data. A CSRF exploit that modifies a budget figure by $50K isn't a technical nuisance—it's operational sabotage with direct financial materiality flowing to board-level decisions and downstream ERP execution. If you're running Planning Analytics, verify CSRF protection actively, not just by checking for the presence of middleware. The most dangerous failure mode isn't absence—it's erosion. As applications undergo refactors, new endpoint patterns may not inherit the CSRF token scope, and protection that existed in 2019 may have been quietly bypassed by architectural changes in 2023. Audit your endpoints with a proxy: send a state-changing request (modify a planning value, create a new allocation) without a CSRF token and observe whether it's accepted. If it succeeds, the protection layer exists on paper but not in the request flow. The fix commit pattern matters for your remediation planning. A single bulk addition of CSRF tokens across all endpoints suggests this was a prioritization gap—the architecture was always capable. A surgical, endpoint-by-endpoint fix suggests genuine complexity in coverage. Either way, request from IBM a clear statement of which endpoints are protected and which remain in the retrofit queue. More broadly, Planning Analytics shares a vulnerability lineage with Cognos, BusinessObjects, and PeopleSoft—all enterprise middleware where authentication was bolt-on rather than foundational. If your environment includes any of these products, assume CSRF protection requires explicit verification; the pattern across this product family suggests assumed presence is not equivalent to functional protection.

Reviewed through automated stages and approved by a human before publication.