Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:25.040Z",
  "pubdate": "2026-11-07T05:18:25.040Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability. This flaw allows a remote authenticated attacker to bypass authorization controls and access sensitive information belonging to other tenants within the multi-tenant environment. The vulnerability stems from insufficient validation of object identifiers during API requests, which fails to verify that the requesting user possesses the necessary ownership or permissions to access the specific resource. Successful exploitation leads to unauthorized data exposure, compromising confidentiality across the API ecosystem. The impact is significant, as it enables cross-tenant data leakage, potentially exposing proprietary business information, configuration details, or user data. This vulnerability requires the attacker to be authenticated within the IBM API Connect environment to initiate the request, but it does not require administrative privileges. Given the nature of BOLA, the attack is executed through the manipulation of resource identifiers within the API request path or parameters, making it a critical concern for organizations relying on the platform for secure multi-tenant service exposure.",
  "technicalDetails": "The identified vulnerability is classified as Broken Object Level Authorization (BOLA), categorized under the OWASP API Security Top 10 framework. The root cause lies in the application's failure to enforce granular authorization checks at the object level when processing requests directed at specific resources. In a multi-tenant IBM API Connect deployment, the system must strictly isolate resources, ensuring that a user authenticated to 'Tenant A' cannot interact with or view resources owned by 'Tenant B'.\nExploitation is facilitated by the API's reliance on predictable or discoverable resource identifiers (such as UUIDs, sequential IDs, or object references) within the URL path or body parameters. When an authenticated user submits a request to a resource endpoint, the backend service fails to validate whether the authenticated session identifier or security context is authorized to access the object specified by the identifier in the request. Consequently, an attacker can modify these identifiers—often through simple enumeration or brute-force techniques—to access objects that do not belong to their own scope.\nThe attack flow follows a structured pattern: 1) The attacker authenticates to their valid tenant account within the IBM API Connect platform. 2) The attacker captures legitimate API requests and identifies the pattern used for resource referencing. 3) The attacker modifies the object ID in the API call to point to resources residing within a different tenant's namespace. 4) The server, having verified the initial authentication, fails to perform a secondary ownership check against the requested object ID. 5) The server processes the request and returns the sensitive data belonging to the target tenant.\nAffected software versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability exists within the request handling logic of the API gateway or the associated management services responsible for resource orchestration. The post-exploitation impact includes unauthorized data exfiltration, breach of tenant isolation boundaries, and potential compliance violations due to the disclosure of sensitive data. Because the exploit relies on exploiting existing, valid API endpoints, detection via standard signature-based WAF rules is difficult, necessitating robust authorization checks at the service logic layer to ensure that every object access is verified against the subject's access control policy."
}