critical · CVSS v3 9.1
CVE-2026-17338
IBM API Connect 12.1.0.0 through 12.1.1.2 suffers from broken object‑level authorization that allows a remote authenticated attacker to acce
Overview
IBM API Connect 12.1.0.0 through 12.1.1.2 suffers from broken object‑level authorization that allows a remote authenticated attacker to access sensitive data. The flaw can expose confidential configuration and user information. It is critical because it bypasses normal access controls.
Description
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Impact
Confidentiality is compromised as attackers can read protected objects. Availability is not directly affected, but the breach can lead to data leakage. Defenders must protect against unauthorized data exposure.
Remediation
Apply the latest IBM API Connect patch (12.1.1.3 or newer) or any vendor‑issued fix. Verify that object‑level permissions are correctly configured and enforce least‑privilege access. Monitor audit logs for anomalous access patterns.
Risk context
Severity is critical with a CVSS v3 score of 9.1, indicating a high urgency to remediate. No EPSS data available.
Affected products
- IBM API Connect 12.1.0.0
- IBM API Connect 12.1.1.2
Scores
- Severity
- critical
- CVSS v2
- 8
- CVSS v3
- 9.1
- CVSS v4
- —
- EPSS
- —