Vulnerability Reference
Excessive *ALLOBJ special authority assigned beyond IT administrators
What Happened
Authority reviews on IBM i systems commonly find *ALLOBJ special authority granted to application and business-user profiles that do not need it, usually inherited from a group profile or carried over from an old troubleshooting grant that was never revoked.
Why It Matters
*ALLOBJ bypasses object-level authority checks entirely. Every profile holding it is effectively a superuser for data access purposes, whether or not that was the intent, which directly undermines segregation-of-duties and audit requirements.
Recommended Actions
- Run an authority collection (STRAUTCOL) or equivalent report to inventory every profile holding *ALLOBJ
- Reconcile the list against actual administrative role requirements and revoke unnecessary grants
- Replace ad hoc *ALLOBJ grants with adopted authority (profile swapping) scoped to specific programs where elevated access is genuinely needed
- Re-run the authority review on a recurring schedule, not as a one-time cleanup
Sources
This is a recurring vulnerability class, not a single-incident CVE. It shows up repeatedly across live IBM i systems in industry security assessments, which is exactly why it is worth checking on yours rather than assuming it was handled.
Other Vulnerability Classes
- Default and weak passwords on powerful profiles (QSECOFR and equivalents) Critical severity
- Unsecured FTP, ODBC, and remote command exit points High severity
- *PUBLIC *CHANGE authority left on production libraries and files Medium severity
- IFS exposure to network-share-originated ransomware encryption High severity