Description
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
Published: 2026-11-07
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Unauthorized Access
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect 12.1.0.0 through 12.1.1.2 includes an improper authorization flaw that allows an authenticated attacker to view or modify resources belonging to another tenant. The vulnerability derives from tenant context not being sufficiently verified against the authenticated user, resulting in cross‑tenant data exposure or tampering. This weakness is identified as CWE‑290.

Affected Systems

All IBM API Connect deployments running versions 12.1.0.0 to 12.1.1.2 are susceptible. Users should confirm their product version and plan an upgrade past 12.1.1.2 to mitigate risk.

Risk and Exploitability

The CVSS score of 8.3 signifies a high severity. EPSS data is not available, so the current probability of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated; once authenticated they can override tenant boundaries and access cross‑tenant resources, potentially compromising data confidentiality and integrity across multiple tenants.

Generated by OpenCVE AI on November 7, 2026 at 07:46 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to version 12.1.1.3 or later to apply the vendor’s patch.
  • Audit tenant isolation controls to verify that every API call validates the user's tenant context against the targeted resource.
  • Review and revoke any credentials that may have been compromised, and enforce least‑privilege permissions for tenants.

Generated by OpenCVE AI on November 7, 2026 at 07:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-290
CPEs cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:34:41.297Z

Reserved: 2026-08-06T15:41:31.318Z

Link: CVE-2026-19121

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:59.963

Modified: 2026-11-07T05:19:00.093

Link: CVE-2026-19121

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T09:15:14Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing