Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-07T05:18:39.780Z",
  "pubdate": "2026-11-07T05:18:39.780Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability, classified as a critical authorization flaw.\nThis vulnerability allows a remote, authenticated attacker to interact with and modify API subscriptions belonging to other users or organizations by manipulating object identifiers within API requests.\nThe core issue resides in the application's failure to perform adequate server-side authorization checks when processing requests for sensitive resources.\nSuccessful exploitation grants an unauthorized actor the ability to manipulate application API subscription states, leading to unauthorized service access, potential data exfiltration, or disruption of third-party API service integrations.\nBecause the vulnerability requires the attacker to be authenticated to the platform, it represents an escalated threat where legitimate access is leveraged to bypass object-level security constraints.\nOrganizations relying on affected versions of IBM API Connect face significant risk regarding multi-tenancy isolation, as the lack of robust ownership validation undermines the integrity of the API management layer.",
  "technicalDetails": "The vulnerability is rooted in the failure of the IBM API Connect authorization module to properly enforce resource ownership boundaries during API subscription management operations.\nIn a secure implementation, the backend application must validate that the authenticated user identity (e.g., via session token or JWT claim) maintains legitimate ownership or administrative rights over the specific object identifier (ID) requested in an API operation.\nIn this instance, the API endpoint responsible for managing subscriptions fails to verify the relationship between the authenticated subject and the target resource ID provided in the request body or URI parameters.\nAn attacker can exploit this via an Insecure Direct Object Reference (IDOR) pattern, where they modify the object ID within a legitimate API request (such as a PUT or PATCH request targeting /subscriptions/{subscription-id}) to reference a resource they are not authorized to manage.\nThe attack flow follows these steps: 1) The attacker authenticates as a legitimate user within the API Connect portal. 2) The attacker captures a legitimate request used to modify their own API subscription. 3) The attacker modifies the object ID field in the request payload or URL to match the target subscription owned by a different user or organization. 4) The server processes the request, failing to validate authorization, and applies the unauthorized changes to the target subscription.\nThis behavior is highly impactful as it allows for the subversion of subscription-based access controls, potentially permitting the attacker to alter, revoke, or redirect API traffic flows associated with targeted subscriptions. The vulnerability affects the core API management component tasked with orchestrating subscription life-cycles. Because the flaw exists at the object level, it effectively bypasses traditional perimeter security, relying entirely on the internal consistency of the authorization middleware which, in these versions, performs incomplete access control logic. The attack is restricted to authenticated sessions but does not require administrative privileges, as the defect lies in the horizontal privilege boundaries (i.e., user-to-user authorization bypass)."
}