Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:20.210Z",
  "pubdate": "2026-11-07T05:18:20.210Z",
  "executiveSummary": "This vulnerability is an improper authorization flaw within IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The security weakness allows a remote authenticated attacker to bypass tenant isolation boundaries, leading to unauthorized access to sensitive information belonging to other tenants. The root cause lies in the application's failure to adequately validate user-supplied identifiers against the authenticated session's permission scope during API requests. Consequently, an attacker can manipulate these identifiers to access data objects, configurations, or resources that should be restricted to separate tenant environments. The risk implication is significant, as it violates the principle of multi-tenant isolation, potentially exposing proprietary data, credentials, or metadata across a shared infrastructure. Exploitation requires the attacker to possess a valid authenticated account within the system, though no elevated administrative privileges are strictly required beyond the ability to perform standard operations that interact with the vulnerable backend logic. Organizations deploying the affected versions of IBM API Connect face a high risk of cross-tenant data exfiltration.",
  "technicalDetails": "The vulnerability resides in the request handling logic of IBM API Connect, where the authorization layer fails to perform comprehensive checks on resource identifiers provided in incoming API requests. In a multi-tenant environment, API Connect is expected to enforce strict scoping, ensuring that an authenticated user can only access resources associated with their specific tenant ID. The flaw specifically manifests as an Insecure Direct Object Reference (IDOR) or broken access control mechanism where the backend infrastructure processes resource identifiers without validating them against the current user's session context or authorization claims.\nThe exploitation flow begins with an authenticated attacker gaining access to the platform. Once authenticated, the attacker identifies API endpoints that accept specific resource or object identifiers as parameters (e.g., IDs for APIs, products, or catalogs). By intercepting these requests, the attacker can systematically modify or guess identifiers associated with other tenants. Because the application logic fails to verify if the requested ID belongs to the authenticated user's tenant, the backend component processes the request and returns the requested object's details or sensitive metadata. This effectively allows the attacker to bypass the logical isolation boundaries established for multi-tenancy.\nThe vulnerable component performs insufficient server-side validation of the authorization mapping between the user's session token and the target object identifier. Instead of validating that the user has explicit read or access rights to the specific object requested, the system relies on the assumption that only valid identifiers will be provided by legitimate users. This lack of rigorous boundary checking permits the leakage of cross-tenant information, which may include sensitive configuration data, service definitions, or internal management information stored within the platform. The impact is significant, as it enables an attacker to conduct reconnaissance and data theft without requiring direct infrastructure access or specialized exploitation tools beyond standard API interaction utilities. The vulnerability persists across all instances of the specified IBM API Connect versions, as the logic error is inherent to the request processing architecture implemented within these releases."
}