Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-07T05:18:23.787Z",
  "pubdate": "2026-11-07T05:18:23.787Z",
  "executiveSummary": "This vulnerability involves a critical authorization flaw within IBM API Connect versions 12.1.0.0 through 12.1.1.2. The security defect is categorized as a missing authorization issue, which facilitates unauthorized cross-tenant data access.\nA remote, authenticated attacker can exploit this weakness to perform unauthorized operations, including the exfiltration of sensitive information and the modification or deletion of data belonging to other tenants within the multi-tenant environment.\nThe risk implication is severe, as it undermines the logical isolation boundaries inherent in the platform, potentially leading to a complete compromise of data confidentiality and integrity for affected tenants.\nSuccessful exploitation requires the attacker to possess valid authentication credentials within the system. The vulnerability does not appear to require elevated administrative privileges, meaning standard authenticated users may potentially conduct cross-tenant attacks.\nIBM API Connect deployments utilizing affected versions are susceptible to these unauthorized actions, necessitating immediate attention to vendor-supplied patches and security configurations.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper access control implementation within the internal API request handling logic of IBM API Connect versions 12.1.0.0 through 12.1.1.2. Specifically, the system fails to adequately validate the authorization context of a user session when interacting with cross-tenant resource endpoints.\nIn a multi-tenant architecture, the system is expected to enforce strict isolation by validating that the 'tenant_id' or associated security context of the authenticated user matches the owner of the requested resource. The vulnerable component fails to perform these checks during the request lifecycle for specific API calls, resulting in an Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) scenario.\nThe attack flow begins with a remote, authenticated attacker identifying valid object identifiers—such as resource IDs, organization IDs, or API definitions—belonging to a different tenant. Because the application logic relies on client-provided or predictable identifiers without validating authorization against the current user's security scope, the attacker can craft malicious API requests.\nBy manipulating these identifiers in the request parameters or body, the attacker sends a request to the API gateway or backend service. The server-side component processes the request under the authenticated user's session but fails to verify if the user possesses the necessary permissions for the target tenant's resources. Consequently, the backend service performs the requested operation—such as GET, PUT, POST, or DELETE—against the foreign tenant's data.\nPost-exploitation, the impact is significant. If the attacker initiates a GET request, they can extract sensitive configuration data, API keys, or proprietary endpoint definitions belonging to another tenant, leading to a breach of confidentiality. If the attacker initiates a DELETE or PUT request, they can cause service disruption or destroy business-critical data, impacting the integrity and availability of the victim's infrastructure.\nThis vulnerability is particularly dangerous because it bypasses the primary security perimeter intended to isolate tenant data. Since the exploitation occurs via standard API protocols, the traffic appears legitimate to traditional network security tools, as it originates from an authenticated session. The absence of adequate authorization checks at the service level permits this lateral movement across tenant boundaries, rendering the logical segmentation ineffective."
}