Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:21.347Z",
  "pubdate": "2026-11-07T05:18:21.347Z",
  "executiveSummary": "A Broken Object Level Authorization (BOLA) vulnerability has been identified in IBM API Connect versions 12.1.0.0 through 12.1.1.2.\nThe vulnerability resides within the authorization logic of the API management layer, failing to adequately validate the ownership or permissions of objects requested by authenticated users.\nThis flaw allows a remote, authenticated attacker to manipulate object identifiers within API requests to access sensitive data belonging to other users or system resources that they are not authorized to view.\nThe impact includes unauthorized information disclosure, potentially leading to the compromise of proprietary configuration data, user information, or business-critical API definitions.\nSuccessful exploitation requires the attacker to have valid authentication credentials within the target API Connect environment, but does not require administrative privileges.\nRisk implications are significant, as BOLA-based attacks are often difficult to detect through standard logging, as the requests appear legitimate from an authentication perspective while violating object-level access boundaries.",
  "technicalDetails": "The vulnerability is a classic Broken Object Level Authorization (BOLA) flaw, occurring because the application relies on user-provided input, such as resource IDs or object identifiers in URL paths or request parameters, without performing a comprehensive server-side check to verify if the requester has explicit authorization to access the specific instance of the requested object.\nIn the affected versions of IBM API Connect (12.1.0.0 through 12.1.1.2), the API management subsystem fails to enforce object-level access controls during the execution of API calls. When a user sends a request to perform an operation on a specific resource, the application verifies the identity of the user via standard authentication protocols (such as OAuth or API keys) but fails to confirm whether the specific resource ID provided in the request corresponds to a resource that the user is authorized to interact with.\nThe attack flow proceeds as follows: First, the attacker establishes a legitimate session by authenticating to the IBM API Connect platform. Second, the attacker performs reconnaissance to identify valid resource IDs, often by observing normal traffic patterns or through sequential brute-forcing of identifiers. Third, the attacker crafts a malicious request by modifying the resource ID parameter in an API call—for example, changing a user-specific ID to one belonging to another entity. Fourth, because the underlying authorization logic lacks object-level boundary validation, the application server processes the request, retrieves the sensitive object data associated with the modified ID, and returns the information to the attacker.\nThis flaw is particularly severe in API-centric architectures where resources are frequently referenced by ID. The lack of validation allows attackers to harvest data across the platform by traversing accessible objects. Post-exploitation impact includes the systematic exfiltration of sensitive information, which can lead to further targeted attacks, unauthorized data exposure, and non-compliance with data privacy regulations. Because the attacker is already authenticated, the malicious requests blend into normal traffic, often bypassing perimeter-based security measures that focus solely on identity verification rather than deep semantic analysis of the authorization context per resource."
}