Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-07T05:18:23.173Z",
  "pubdate": "2026-11-07T05:18:23.173Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an authorization bypass vulnerability. This flaw enables a remote, authenticated attacker to circumvent established access controls, leading to the unauthorized disclosure of sensitive information and the illicit modification of arbitrary documents.\nThe vulnerability originates from a failure in the application's authorization logic when processing user-controlled keys. By manipulating these keys during request submission, an attacker can escalate privileges or gain access to resources for which they lack the necessary permissions. This represents a significant security risk, as it compromises the confidentiality and integrity of the API ecosystem managed by the platform.\nThe exploitation of this vulnerability requires the attacker to be authenticated to the target system. Once access is established, the attacker can leverage the flaw to interact with internal documents or sensitive data objects, effectively bypassing the intended security policy enforced by the product. Organizations utilizing the affected versions should prioritize updates to mitigate this risk, as this flaw allows for unauthorized administrative or data-access actions that could be leveraged for further malicious activities within the API gateway environment.",
  "technicalDetails": "The vulnerability resides in the request handling mechanism of IBM API Connect versions 12.1.0.0 through 12.1.1.2, where authorization validation is improperly implemented concerning user-provided keys. Specifically, the internal access control check relies on identifiers or keys supplied within the client request without sufficient server-side verification against the authenticated user's session context or scope.\nRoot Cause: The root cause is an insecure direct object reference (IDOR) or equivalent authorization logic error. When a client requests access to a specific document or resource, the system fails to validate that the authenticated user holds the required authorization level for the specific resource identifier provided in the request payload or URL parameters. Consequently, the backend application honors the user-supplied key to grant access to the resource, treating the key as a trusted parameter rather than an untrusted user input.\nAttack Flow: An attacker with valid credentials initiates an interaction with the API Connect interface. During an API call meant to retrieve or update a document, the attacker intercepts the request and identifies the field containing the document identifier or key. By substituting the legitimate key with one belonging to a different resource (such as a system-level configuration or another user's private data), the attacker bypasses the internal authorization check. The application processes the request, assuming the user has permission to access the resource associated with the manipulated key. This effectively grants the attacker read and write access to unauthorized sensitive endpoints or documents.\nImpact: Successful exploitation results in the exposure of sensitive API definitions, environment secrets, or arbitrary documents stored within the platform. Furthermore, the ability to modify these documents allows for malicious configuration changes, potentially disrupting service availability or injecting malicious logic into the API deployment pipeline. Because this occurs at the authorization layer, the impact is comprehensive, covering all data objects exposed through the vulnerable entry points. The exploitation does not require advanced network positioning, only the ability to authenticate to the management or portal interface of the affected IBM API Connect instance."
}