Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-07T05:18:36.330Z",
  "pubdate": "2026-11-07T05:18:36.330Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability has been identified in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis vulnerability allows a remote, authenticated attacker to manipulate organization ownership, effectively enabling unauthorized takeover of organizations they do not control.\nThe flaw stems from incomplete access control checks performed on organization objects during sensitive operations.\nThe risk implication is critical, as it bypasses standard authorization boundaries within the multi-tenant architecture of the API management platform.\nSuccessful exploitation requires the attacker to have valid authentication credentials within the system; however, no administrative privileges are inherently required to target organizations outside their scope.\nThe impact includes full administrative compromise of affected organizations, leading to potential data exposure, configuration modification, and loss of control over API lifecycles.",
  "technicalDetails": "The vulnerability resides within the authorization logic governing object-level access in IBM API Connect. Specifically, the application fails to adequately validate the security context of a request when modifying the ownership attributes of an organization.\nThe root cause is a deficiency in the authorization middleware or the specific API endpoint handler responsible for managing organization hierarchies and ownership assignments. Instead of strictly enforcing a 'Resource-Owner-Only' policy, the application performs incomplete access checks, allowing an authenticated user to submit a request that modifies organization metadata for objects they do not possess permissions to manage.\nExploitation follows a predictable path: 1) The attacker initiates an authenticated session within the platform. 2) The attacker identifies the API endpoints responsible for organizational administration or ownership reassignment. 3) By manipulating the request parameters (likely object IDs associated with a target organization) and sending a crafted payload to the vulnerable endpoint, the attacker bypasses the intended authorization guardrails. 4) The backend service processes the request, updating the database entries to reflect the attacker as the owner of the target organization, despite the lack of authorization context.\nBecause the vulnerability is a form of BOLA, it demonstrates a failure in the application's capability to verify that the 'actor' (the authenticated user) is the 'owner' (authorized entity) of the requested 'object' (organization). This discrepancy allows horizontal and vertical privilege escalation, where a standard user gains control over foreign organizational assets.\nThe attack is persistent once the ownership update is committed, granting the attacker ongoing access to the target organization's APIs, developers, and integrated services. This level of access enables the attacker to orchestrate further downstream attacks, such as modifying API security policies, intercepting traffic, or exfiltrating sensitive organizational data processed through the API Connect environment.\nAffected versions include 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2. The vulnerability is network-accessible to any authenticated user, necessitating urgent remediation for multi-tenant environments where strict isolation is required."
}