Medium severity · published Mar 3, 2026
CVE-2025-13734
IBM Engineering Requirements Management DOORS Next could allow an authenticated user to access and modify data beyond authorized permissions
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
Engineering Requirements Management DOORS Next · IBM
7.1 through rage Scale 5.2.3.0 - 5.2.3.5; 7.2 through rage Scale 6.0.0.0 - 6.0.0.1 · source: vendor, NVD
Affected product
ER
Engineering Requirements Management DOORS Next
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13734
Vendor Advisory
https://www.ibm.com/support/pages/node/7261900
More from Engineering Requirements Management DOORS Next
7.5
CVE-2024-41771
IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other…
7.5
CVE-2024-41770
IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other…
7.5
CVE-2020-4965
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
6.5
CVE-2025-33096
IBM Engineering Requirements Management Doors Next denial of service
6.5
CVE-2024-43169
IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the code