Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:34.520Z",
  "pubdate": "2026-11-07T05:18:34.520Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis vulnerability allows a remote, authenticated attacker to gain unauthorized access to sensitive information by manipulating object identifiers.\nThe flaw stems from insufficient server-side validation of object ownership or authorization permissions when a user performs requests targeting specific API resources.\nBy bypassing standard access control checks, an attacker can perform unauthorized operations on objects for which they lack the necessary privileges.\nThe potential impact includes unauthorized data disclosure, exposure of sensitive configuration details, or unauthorized access to protected API resources.\nSuccessful exploitation requires the attacker to hold an authenticated session, though they do not require administrative or high-level privileges beyond basic authentication.\nOrganizations using the specified versions of IBM API Connect are at risk of data breaches through object-level permission bypasses and are encouraged to apply vendor-supplied patches once available.",
  "technicalDetails": "The vulnerability is rooted in a failure of the authorization layer within the IBM API Connect framework to properly enforce object-level permissions. In a secure implementation, an API gateway or underlying service must verify that the authenticated user initiating a request is authorized to perform the requested operation on the specific resource identified in the URI or request body.\nIn the context of this BOLA vulnerability, the application fails to validate the relationship between the authenticated user's security context and the requested object identifier. When a request is made, the backend performs a check to determine if the user is authenticated, but fails to check if the specific resource requested—often represented by a unique ID—belongs to the user or if the user possesses the appropriate permissions to view or interact with that specific object.\nAn attacker can exploit this by intercepting requests directed toward API endpoints that interact with identifiable objects. By incrementing or modifying the object identifiers (such as ID numbers, resource strings, or UUIDs) within the API request parameters, the attacker can force the application to serve data associated with other users or entities.\nThe attack flow proceeds as follows: First, the attacker establishes a valid, authenticated session with the IBM API Connect environment. Second, the attacker performs legitimate API calls to observe the structure of requests and identify the parameters that govern object selection. Third, the attacker manipulates these parameters, swapping their own valid identifiers for target identifiers of unauthorized resources. Fourth, the server processes the request, verifying only the user's general authentication status, and then returns the sensitive data associated with the requested, unauthorized object.\nBecause the server lacks granular authorization checks, the application treats the attacker's request as legitimate, bypassing the logical isolation between users. This flaw exists across the API management, gateway, or management components of the affected versions, specifically IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The lack of proper server-side authorization enforcement means that the vulnerability is entirely dependent on the application's failure to map the user's session token to the specific object resource permissions. Post-exploitation, the attacker can systematically scrape, monitor, or exfiltrate sensitive data across the API surface."
}