Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Published: 2026-11-07
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: Sensitive Data Exposure
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw in object‑level authorization that may allow a remote authenticated attacker to read protected data. The weakness is classified as CWE‑639, indicating that the system fails to enforce appropriate permissions on individual objects.

Affected Systems

The affected products are IBM API Connect for the 10.x series (10.0.8.0 to 10.0.8.12) and the 12.x series (12.1.0.0 to 12.1.1.2). Users running these versions are at risk unless they upgrade to the patched releases identified by IBM.

Risk and Exploitability

The CVSS score of 7.7 reflects a high severity impact. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalogue, suggesting limited evidence of widespread exploitation yet does not eliminate the risk. The likely attack vector is a remote authenticated user who can exploit the broken authorization to extract sensitive information from the API Connect instance.

Generated by OpenCVE AI on November 7, 2026 at 07:56 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Apply the IBM security patch by upgrading to API Connect v12.1.1.3 for the 12.x series or v10.0.8.13 for the 10.x series, which removes the broken object‐level authorization issue.
  • If an upgrade cannot be performed immediately, enforce stricter IAM policies by restricting API permissions to the minimum necessary roles and disabling any unused service accounts.
  • Enable comprehensive logging and monitoring for API calls that access sensitive resources, and investigate any abnormal access patterns to detect potential exploitation attempts.

Generated by OpenCVE AI on November 7, 2026 at 07:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-639
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:34:12.527Z

Reserved: 2026-07-25T04:23:05.102Z

Link: CVE-2026-17387

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:53.060

Modified: 2026-11-07T05:18:53.207

Link: CVE-2026-17387

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:30:14Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key