Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Published: 2026-11-07
Score: 5 Medium
EPSS: n/a
KEV: No
Impact: Sensitive data disclosure via broken object-level authorization
Action: Apply patch
AI Analysis

Impact

The vulnerability in IBM API Connect permits a remote authenticated attacker to retrieve sensitive information because the system fails to enforce object‑level authorization correctly. This flaw is classified as CWE‑639 and indicates an authorization bypass that can expose confidential data.

Affected Systems

IBM API Connect is impacted. Versions 10.0.8.0 through 10.0.8.12 inclusive, and 12.1.0.0 through 12.1.1.2 inclusive, are known to contain the flaw. Admins using any of these release lines should evaluate the presence of the vulnerability.

Risk and Exploitability

The CVSS score of 5.0 reflects a moderate risk. Because the attacker must be authenticated, the attack surface is limited, and no public exploits are presently documented. IBM recommends upgrading immediately to version 12.1.1.3 (or to 10.0.8.13 for the 10.x line) to address the issue, as the vulnerability is not listed in the CISA KEV catalog and EPSS data are unavailable.

Generated by OpenCVE AI on November 7, 2026 at 06:10 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade the IBM API Connect installation to version 12.1.1.3 (or 10.0.8.13 if using that release line) following IBM Fix Central guidance.
  • Reconfigure or reduce privileged accounts so that only required users can authenticate to the API Connect server.
  • Enable or review audit logging to flag unauthorized data requests.

Generated by OpenCVE AI on November 7, 2026 at 06:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-639
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:33:58.269Z

Reserved: 2026-07-25T03:49:31.392Z

Link: CVE-2026-17371

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:50.023

Modified: 2026-11-07T05:18:50.173

Link: CVE-2026-17371

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T07:15:16Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key