Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
Published: 2026-11-07
Score: 5 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure via Insecure Direct Object Reference
Action: Apply Patch
AI Analysis

Impact

The CVE describes an insecure direct object reference in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 that can allow a remote authenticated attacker to access sensitive data. Because validation of object identifiers is insufficient, attackers can request resources belonging to other users, resulting in disclosure of confidential information and unauthorized data retrieval.

Affected Systems

Affected vendors include IBM, product IBM API Connect. The vulnerable releases comprise 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2.

Risk and Exploitability

The CVSS score of 5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Exploitation requires authenticated access and a valid user session; an attacker can trigger the IDOR by manipulating resource identifiers in authenticated requests. IBM recommends addressing the issue immediately by upgrading to 12.1.1.3 or 10.0.8.13.

Generated by OpenCVE AI on November 7, 2026 at 08:29 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to 12.1.1.3 or 10.0.8.13, the latest releases that contain the fix.
  • Limit object access through IAM policies so that only authorized users can reference sensitive objects.
  • Implement additional validation for resource identifiers to prevent direct object reference attacks.

Generated by OpenCVE AI on November 7, 2026 at 08:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-639
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:31:38.367Z

Reserved: 2026-07-24T13:54:48.872Z

Link: CVE-2026-17064

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:23.557

Modified: 2026-11-07T05:18:23.733

Link: CVE-2026-17064

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:30:15Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key