high · CVSS v3 8.3

CVE-2026-19121

IBM API Connect versions 12.1.0.0 through 12.1.1.2 allow an authenticated user to access resources belonging to another tenant due to insuff

Overview

IBM API Connect versions 12.1.0.0 through 12.1.1.2 allow an authenticated user to access resources belonging to another tenant due to insufficient tenant context verification. This flaw can expose sensitive data and compromise the integrity of tenant environments. It is a high‑severity vulnerability with a CVSS v3 score of 8.3.

Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.

Impact

Confidentiality and integrity of tenant data are at risk, as attackers can read or modify resources they should not access. The flaw primarily impacts administrators and tenants who rely on strict isolation between environments. Availability is not directly affected, but compromised data can lead to broader operational disruptions.

Remediation

Apply the latest IBM API Connect patch (12.1.1.3 or later) which corrects tenant context validation. If patching is not immediately possible, enforce strict RBAC and tenant isolation policies, audit API calls for tenant mismatches, and restrict privileged API access to trusted users only.

Risk context

The vulnerability is classified as high severity with a CVSS v3 score of 8.3, indicating a significant risk. Immediate remediation is recommended to prevent potential data exposure across tenants.

Affected products

  • IBM API Connect 12.1.0.0
  • IBM API Connect 12.1.1.2

Scores

Severity
high
CVSS v2
8.7
CVSS v3
8.3
CVSS v4
—
EPSS
—

IBM API Connect tenant isolation authorization high severity confidentiality integrity

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis