*PUBLIC *CHANGE authority left on production libraries and files
What Happened
Many IBM i shops still run production libraries with *PUBLIC authority set to *CHANGE (or higher) at the library or object level, a legacy default from earlier system setup practices rather than a deliberate access-control decision.
Why It Matters
*PUBLIC *CHANGE means any profile without an explicit, more restrictive authority can update or delete data in that library by default. Combined with broad ODBC/FTP access, this is one of the most common paths to unauthorized data modification found in IBM i security assessments.
Recommended Actions
- Inventory *PUBLIC authority settings on production libraries and files
- Move toward *PUBLIC *EXCLUDE or *USE with explicit group-profile grants for the access levels actually required
- Use adopted authority in application programs rather than broad *PUBLIC grants to give users the access they need
- Test authority changes in a non-production environment first; tightening *PUBLIC authority is the change most likely to break an existing integration if done without testing
Sources
This is a recurring vulnerability class, not a single-incident CVE. It shows up repeatedly across live IBM i systems in industry security assessments, which is exactly why it is worth checking on yours rather than assuming it was handled.
Other Vulnerability Classes
- Default and weak passwords on powerful profiles (QSECOFR and equivalents) Critical severity
- Excessive *ALLOBJ special authority assigned beyond IT administrators High severity
- Unsecured FTP, ODBC, and remote command exit points High severity
- IFS exposure to network-share-originated ransomware encryption High severity