medium · CVSS v3 5

CVE-2026-17428

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 allow a remote authenticated attacker to access data belonging to other us

Overview

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 allow a remote authenticated attacker to access data belonging to other users because URL parameters are used in authorization checks without proper validation. This flaw can lead to unintended data disclosure across tenants or users. The vulnerability is rated medium severity.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.

Impact

Confidentiality is compromised as attackers can read sensitive information they should not see. Integrity is at risk if attackers modify data they can access. Availability is not directly affected. The primary impact is on organizations running the affected IBM API Connect versions, especially in multi‑tenant environments.

Remediation

Apply the latest IBM security patches for API Connect (10.0.8.13 or later, 12.1.1.3 or later). If patching is not immediately possible, enforce strict role‑based access controls and validate all URL parameters before using them in authorization logic. Disable or restrict any API endpoints that expose sensitive data without proper checks, and monitor logs for anomalous access patterns.

Risk context

The CVSS v3 score of 5.0 indicates a medium risk level. No EPSS data is available, so the urgency is based solely on the severity rating. Defenders should treat this as a moderate priority but not an emergency.

Affected products

  • IBM API Connect 10.0.8
  • IBM API Connect 12.1.0

Scores

Severity
medium
CVSS v2
4
CVSS v3
5
CVSS v4
—
EPSS
—

IBM API Connect Authorization Data Leakage Medium Severity

← All CVEs

Related CVEs

medium

CVE-2026-118528

The Directorist WordPress plugin (versions <8.11) fails to verify listing ownership before returning metadata via an AJAX action. This flaw lets any authenticated user with Subscriber or higher role read private and unpublished draft listings of other users. The exposed data includes contact information, potentially compromising user privacy.

View analysis

medium

CVE-2026-118204

The WP Data Access – App Builder plugin for WordPress is vulnerable to stored XSS via the ImageURL column value. Authenticated users with subscriber-level access can inject scripts that run when others view the page. This flaw allows malicious code to execute in the context of site visitors.

View analysis

medium

CVE-2026-121792

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_ . (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.

View analysis

medium

CVE-2026-93902

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/ /, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.

View analysis