high · CVSS v3 7.7

CVE-2026-17387

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 have a flaw that allows an authenticated user to bypass object‑level acces

Overview

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 have a flaw that allows an authenticated user to bypass object‑level access controls and read sensitive data. The vulnerability can be exploited remotely by users with valid credentials. It exposes confidential information that could be leveraged for further attacks.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Impact

Confidentiality: Sensitive data may be disclosed to unauthorized users. Integrity: Potential for data tampering if attacker gains write access. Availability: No direct impact. Defenders: System administrators and security teams must verify patch status and enforce least privilege.

Remediation

Apply IBM security update that fixes the broken object‑level authorization in API Connect. If patch cannot be applied immediately, restrict API Connect user roles to the minimum required and disable any unused APIs. Monitor audit logs for anomalous access patterns.

Risk context

High severity (CVSS 7.7) indicates significant risk. No EPSS data available. Defenders should treat this as a priority vulnerability.

Affected products

  • IBM API Connect 10.0.8
  • IBM API Connect 12.1.0
  • IBM API Connect 12.1.1

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.7
CVSS v4
—
EPSS
—

IBM API Connect Authorization Data Exposure High Severity Patch Authentication

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis