Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.
Published: 2026-11-07
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation – Ownership Takeover
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that permits a remote authenticated attacker to alter the ownership of organization objects. Because access checks on organization objects are incomplete, the attacker can transfer ownership to a user they do not control, effectively enabling a privilege escalation within the tenant.

Affected Systems

Affected vendors and products include IBM API Connect. The vulnerable versions are all 10.0.8 releases up to 10.0.8.12 and the 12.1.x releases up to 12.1.1.2. Organizations running these editions on any supported platform are at risk.

Risk and Exploitability

The CVSS score of 9.1 indicates high severity. An EPSS score is not available. The vulnerability is remote and requires authenticated access, meaning an attacker must have valid credentials for exploitation. It is not listed in the CISA KEV catalog, and no public exploits are known at this time.

Generated by OpenCVE AI on November 7, 2026 at 08:21 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to the latest fixed release (12.1.1.3 for 12.1.x streams or 10.0.8.13 for 10.0.x streams).
  • Review and enforce least‑privilege access controls, removing "Organization Owner" permissions from users that do not require them.
  • Temporarily restrict API endpoints that modify organization ownership until the patch is applied, or apply an API policy that enforces ownership verification.

Generated by OpenCVE AI on November 7, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-639
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:32:44.617Z

Reserved: 2026-07-25T00:36:20.247Z

Link: CVE-2026-17292

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:36.330

Modified: 2026-11-07T05:18:36.513

Link: CVE-2026-17292

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T10:30:11Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key