This vulnerability is a textbook authentication-authorization conflation: the DS8900F management interface verified that a user was logged in but never checked whether that user held the specific capability required to grant elevated roles. Any authenticated session could reach the user creation endpoint and assign privileged roles — that's the core failure.
What matters here isn't just patching this one function. The version range tells a more important story: this gap survived from firmware 89.40.83.0 through 89.44.25.0 across multiple release cycles involving hardware compatibility updates, protocol changes, and security releases. If IBM's authorization layer had instrumentation or if their review process targeted privilege escalation paths, this function should have surfaced. Its persistence across releases proves the gap was invisible to their own defenses — that's the structural failure signature.
The fix scope is what determines whether this is genuinely resolved or patched-and-waiting. Examine what IBM actually changed: did they add a single capability check targeting one role string, or did they gate the entire role-granting capability at the authorization layer? The former leaves the underlying pattern intact; the latter approaches structural remediation. You can't determine this from the CVE alone — you need to review the patch commit.
For defenders: audit your firmware version immediately. More importantly, treat this CVE as evidence of a broader pattern until proven otherwise. Examine other management functions in this firmware for the same authentication-without-authorization gap — privileged operations that verify login but skip capability verification. Storage array management interfaces occupy a unique blast radius: compromising them doesn't just compromise one workload, it compromises the layer holding every VM, database, and dataset at rest. The CVSS 8.8 score doesn't model that asymmetry. Prioritize remediation not just by severity but by the foundational nature of the compromised asset.