Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:20.543Z",
  "pubdate": "2026-11-07T05:18:20.543Z",
  "executiveSummary": "A Broken Object Level Authorization (BOLA) vulnerability has been identified in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis vulnerability stems from improper validation of authorization tokens or object ownership checks within the API management interface.\nThe flaw allows a remote, authenticated attacker to bypass intended access controls and gain unauthorized access to sensitive information belonging to other tenants within the same API Connect environment.\nThe primary risk involves unauthorized data exposure and potential cross-tenant information leakage, compromising the confidentiality and isolation guarantees of the multi-tenant architecture.\nExploitation requires the attacker to have valid authentication credentials within the target system, leveraging these credentials to manipulate object identifiers to access resources they are not authorized to view or manage.\nThe vulnerability highlights a failure in the application's authorization logic where the server fails to verify that the requesting user has the appropriate permissions for the specific object requested.",
  "technicalDetails": "The vulnerability is classified as a Broken Object Level Authorization (BOLA) issue, specifically occurring when the application fails to perform sufficient validation on the server-side regarding the relationship between the authenticated user's session and the requested resource identifier.\nIn the affected IBM API Connect versions, the system utilizes API endpoints to perform CRUD operations on objects associated with tenant data. The root cause lies in the application's backend logic, which incorrectly trusts user-supplied identifiers (such as UUIDs, resource IDs, or URI parameters) without sufficiently verifying if the authenticated subject possesses the required entitlements to interact with the target object.\nThe attack flow typically follows a predictable sequence: First, the attacker establishes an authenticated session as a legitimate user within a specific tenant. Second, the attacker performs reconnaissance to identify the structure of API requests, particularly those involving object identifiers. Third, the attacker manipulates these identifiers in subsequent requests, substituting the IDs belonging to their own tenant with those belonging to other tenants.\nBecause the application backend does not perform an exhaustive cross-check between the authenticated user's security context (e.g., tenant ID, roles, or claims) and the resource's ownership metadata, the server processes the request as legitimate, returning the sensitive information associated with the target resource.\nThis behavior bypasses the expected logical isolation in multi-tenant deployments. Since the vulnerability is triggered via standard API calls, the attacker can systematically traverse or harvest data across different tenants by iterating through resource IDs or utilizing gathered intelligence on target resource naming patterns.\nThe impact is significant, as it results in unauthorized information disclosure, potentially exposing configuration data, sensitive metadata, or other proprietary information hosted within the affected IBM API Connect instance. The exploitation does not require administrative privileges, merely a valid, authenticated user account, which lowers the barrier for entry for malicious actors operating within the environment."
}