Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:41.520Z",
  "pubdate": "2026-11-07T05:18:41.520Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This security flaw originates from improper authorization checks when handling requests to sensitive object references.\nThe vulnerability enables a remote, authenticated attacker to bypass intended access controls and gain unauthorized access to sensitive information that should otherwise be restricted. By manipulating object identifiers within API calls, an attacker can coerce the system into disclosing data belonging to other users or system resources.\nThe risk implication is significant as it facilitates unauthorized data exposure, potentially leading to the leakage of PII, internal system configuration data, or other sensitive metadata. Successful exploitation requires the attacker to possess a valid authentication token for the affected environment, though no administrative privileges are inherently required. The vulnerability is categorized as an access control failure, highlighting a critical weakness in the enforcement of authorization logic at the object level.",
  "technicalDetails": "The vulnerability resides in the authorization layer of IBM API Connect, specifically impacting how the platform validates user permissions against direct object references during HTTP requests. An IDOR (Insecure Direct Object Reference) occurs when an application provides direct access to objects based on user-supplied input without performing adequate validation to ensure the requesting user is authorized to interact with the specific object identifier.\nIn the context of the affected versions (12.1.0.0 through 12.1.1.2), the application fails to enforce granular access control policies when processing requests that reference system or user-specific objects by ID. A remote attacker with legitimate, low-level authentication can systematically enumerate or guess identifiers (such as GUIDs, integer-based IDs, or URI-path parameters) for objects they are not permitted to access.\nThe exploitation flow typically follows these steps: First, the attacker establishes a valid session within the IBM API Connect platform. Second, the attacker captures legitimate traffic to identify the API endpoints that utilize identifiers for data retrieval. Third, the attacker modifies these identifiers (e.g., changing a resource ID in the URL path or the request body) to target objects associated with other tenants or restricted system components. Fourth, because the server-side logic fails to cross-reference the user's session context with the requested resource's ownership metadata, the application erroneously processes the request and returns the sensitive data in the HTTP response.\nThis flaw suggests that the underlying business logic layer lacks consistent implementation of authorization checks (often referred to as Broken Access Control). The vulnerability is exposed via the network, and the impact is essentially a violation of confidentiality. Post-exploitation, the attacker may harvest sensitive configuration details, API keys, or user data, which could be leveraged to escalate privileges or facilitate further compromise of the integrated ecosystem. The root cause is the reliance on unverified user-supplied input to perform data-level authorization decisions, bypassing the expected security controls implemented at the higher application tiers."
}