IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

IBM Concert versions 1.0.0 through 2.3.1 are affected by a SQL injection vulnerability tracked as CVE-2026-3627. A remote attacker can send specially crafted SQL statements to exploit this flaw. Successful exploitation could allow the attacker to view, add, modify, or delete data in the back-end database. The vulnerability poses a significant risk to data confidentiality, integrity, and availability. IBM has published an advisory with remediation guidance. No authentication requirement is specified, suggesting the attack surface may be broad. Organizations using affected versions of IBM Concert should apply patches or mitigations promptly. The vulnerability is catalogued in the NVD and carries a high criticality rating.