Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.
Published: 2026-11-07
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: Information Disclosure via Cross‑Tenant Access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows a remote authenticated attacker to retrieve sensitive information from other tenants by submitting requests that include identifiers not properly validated against the user's permissions. This results in unauthorized disclosure of tenant data, compromising confidentiality. It is classified as an authorization bypass (CWE‑639).

Affected Systems

This issue affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability exists in the API handling logic of these releases, allowing tenant‑to‑tenant data access via improperly checked identifiers.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity. The EPSS score is not available, but the lack of exploitation data suggests a moderate likelihood of attack. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploits. The likely attack vector is remote authenticated API calls with manipulated identifiers. An attacker must first authenticate to one tenant; once authenticated, they can manipulate request parameters to access data from other tenants.

Generated by OpenCVE AI on November 7, 2026 at 08:38 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to v12.1.1.3 or 10.0.8.13 as recommended by IBM.
  • If a patch cannot be applied immediately, block or restrict API calls that include tenant identifiers until proper validation is restored.
  • Strengthen IAM and tenant isolation controls, and monitor for anomalous cross‑tenant requests.

Generated by OpenCVE AI on November 7, 2026 at 08:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-639
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:31:21.606Z

Reserved: 2026-07-23T02:13:57.218Z

Link: CVE-2026-16712

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:20.210

Modified: 2026-11-07T05:18:20.337

Link: CVE-2026-16712

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:45:05Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key