Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:34.297Z",
  "pubdate": "2026-11-07T05:18:34.297Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists within IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability resides in the authorization logic governing access to API resources, allowing authenticated remote attackers to bypass object-level access controls.\nBy manipulating API requests, an attacker can gain unauthorized access to sensitive information to which they should not have access.\nThis flaw impacts the confidentiality of data managed by the API Connect platform, as the system fails to verify that the requesting user has the appropriate permissions for specific objects.\nExploitation requires the attacker to have valid authentication within the system, but does not require high-level administrative privileges, leveraging the flawed authorization checks to access resources owned by other users or entities.\nOrganizations using the identified versions are at risk of data exfiltration and unauthorized information disclosure.",
  "technicalDetails": "The vulnerability is classified as Broken Object-Level Authorization (BOLA), which occurs when an application relies on user-provided input to access objects without performing adequate authorization checks to ensure the requester is authorized to access the specific resource identifier.\nIn the context of IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2, the application's underlying authorization mechanisms fail to correctly validate the relationship between the authenticated user's session context and the requested object ID.\nThe attack flow begins when an attacker, possessing a valid session, initiates an API request targeting a specific resource. Rather than relying on the server-side session state to enforce access boundaries, the application processes the resource identifier supplied in the API call (e.g., via URI path parameters, query parameters, or request bodies) without verifying if the user has legitimate ownership or authorization for that specific entity.\nBy systematically iterating or manipulating these resource identifiers—a process often referred to as 'Insecure Direct Object Reference' (IDOR) exploitation—an authenticated attacker can force the application to serve data belonging to other users or sensitive system objects.\nBecause the server-side application logic assumes that the existence of an active authentication token is sufficient for authorization, it proceeds to process the request and returns the sensitive data in the HTTP response.\nThis behavior bypasses the expected Principle of Least Privilege, as the authenticated user is not restricted to their own objects.\nThe vulnerability is exposed over the network, as API endpoints that perform data retrieval are reachable by remote authenticated users.\nPost-exploitation impact includes the unauthorized disclosure of sensitive business data, configuration details, or user information, leading to potential data breaches and significant violations of confidentiality requirements within the API ecosystem.\nThe root cause is a failure in the application's middleware or API gateway controller logic to perform rigorous secondary authorization checks against the object-level identifier provided in the request payload."
}