Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-11-07T05:18:26.030Z",
  "pubdate": "2026-11-07T05:18:26.030Z",
  "executiveSummary": "This vulnerability involves an Insecure Direct Object Reference (IDOR) flaw within IBM API Connect versions 12.1.0.0 through 12.1.1.2. The security defect allows a remote authenticated attacker to bypass authorization controls to access sensitive data or trigger a denial of service (DoS) condition.\nThe core issue stems from insufficient access control checks when processing requests for specific object references. By manipulating input parameters, an authenticated user can perform unauthorized operations on objects they are not permitted to access.\nThe impact includes unauthorized information disclosure, potentially exposing configuration details, API definitions, or sensitive metadata, alongside the capacity to disrupt service availability. This poses a significant risk to the integrity and availability of API management workflows.\nExploitation requires the attacker to possess valid authentication credentials within the target system, meaning the vulnerability is restricted to users who have already gained access to the platform. There are no requirements for administrative privileges; however, the attacker must have sufficient knowledge of the API structure to craft malformed requests targeting vulnerable object references.",
  "technicalDetails": "The vulnerability resides within the authorization logic of IBM API Connect versions 12.1.0.0 through 12.1.1.2. An Insecure Direct Object Reference (IDOR) occurs when the application exposes a reference to an internal implementation object, such as a database key, filename, or resource identifier, without implementing adequate server-side authorization checks.\nIn the context of IBM API Connect, the affected component fails to validate that the authenticated requester has the requisite ownership or permission level for the specific object identifier being requested in the URI or payload. When an authenticated user submits a request, the system maps the provided direct object reference to an internal resource. If the access control mechanism does not verify the subject's relationship to that resource, the system will process the request as if the user were authorized.\nThe attack flow proceeds as follows: First, a remote attacker establishes an authenticated session with the IBM API Connect environment. Second, the attacker performs reconnaissance to identify predictable resource identifiers, such as API IDs, consumer organization IDs, or policy configurations. Third, the attacker transmits a crafted HTTP request (typically a GET, PUT, or DELETE request) modifying the direct object reference parameter to target resources belonging to other tenants or restricted scopes. Fourth, the backend processes the request without validating authorization, returning the sensitive data associated with the requested ID or executing the requested action.\nRegarding the Denial of Service (DoS) capability, an attacker might leverage the IDOR flaw to request or delete critical configuration objects, or repeatedly query large, non-cached, or computationally expensive objects. By manipulating these references, an attacker can exhaust system resources, lock concurrent sessions, or corrupt the state of API management objects, leading to service unavailability.\nBecause the vulnerability is inherent to the authorization framework of the specified versions, it persists across any network segment reachable by an authenticated user. The post-exploitation impact is limited only by the permissions associated with the direct object references accessible through the vulnerable endpoints, which may grant the attacker unauthorized visibility into the API gateway configuration, deployment settings, or consumer data."
}