Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:36.570Z",
  "pubdate": "2026-11-07T05:18:36.570Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability permits a remote authenticated attacker to perform unauthorized modifications to user profile information.\nThe root cause is an inadequate implementation of server-side access control checks, which fail to validate whether the authenticated requester possesses the necessary authorization to manipulate the targeted user profile object.\nThis flaw allows for unauthorized data manipulation, potentially compromising user account integrity and privacy.\nSuccessful exploitation requires the attacker to have valid authentication credentials to the platform, after which they can leverage the lack of authorization validation to target other users' profile data.\nThe risk implication is significant as it allows for unauthorized profile attribute changes, which could be leveraged for account takeover, identity impersonation, or data exfiltration, depending on the nature of the modifiable profile fields.",
  "technicalDetails": "The vulnerability is identified as a classic Broken Object-Level Authorization (BOLA) flaw occurring within the IBM API Connect user management or profile update functionality.\nThe primary technical failure occurs when the application processes requests to modify user profile attributes. While the application confirms that the requester is authenticated, it fails to perform an authorization check on the specific object being modified.\nTypically, in a RESTful API or application endpoint handling user profile updates, the request would involve a unique identifier for the user (e.g., a 'user_id' in a URI or request body). The application logic should verify that the 'user_id' in the request matches the identity of the authenticated session, or that the requester possesses administrative privileges to modify the target object.\nIn the case of this vulnerability, the server-side component responsible for handling the update request performs the operation based solely on the provided object reference without validating that the authenticated user is authorized to perform changes on that specific resource.\nThe attack flow proceeds as follows: 1) The attacker authenticates legitimately to the IBM API Connect environment. 2) The attacker intercepts or crafts an API request intended to modify profile data, specifically targeting an identifier belonging to a different user. 3) The application receives the request, identifies that the user is authenticated, and proceeds to execute the write operation against the backend database or directory service for the specified target object.\nBecause the authorization logic is bypassed or missing at the object level, the server fails to reject the request, resulting in the unauthorized modification of the target user's profile information.\nThis vulnerability is restricted to authenticated users, meaning the scope of exploitation is limited to those who already have access to the system, such as internal users, partners, or compromised accounts.\nThe post-exploitation impact includes the potential for identity-based attacks. By modifying fields such as email addresses, contact information, or other metadata, an attacker could facilitate subsequent attacks, such as password resets or account takeover, by redirecting communications or altering security parameters associated with the victim's account.\nThis flaw specifically affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2."
}