Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-07T05:18:45.083Z",
  "pubdate": "2026-11-07T05:18:45.083Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists in IBM API Connect, affecting versions 12.1.0.0 through 12.1.1.2.\nThe vulnerability permits a remote authenticated attacker to bypass authorization controls and gain unauthorized access to sensitive information.\nThis flaw occurs because the application fails to adequately validate if the authenticated user has sufficient permissions to access specific object resources via API calls.\nSuccessful exploitation allows an attacker to manipulate resource identifiers within API requests to retrieve data belonging to other users or system entities.\nThe risk is categorized as high, as it directly undermines the confidentiality of the managed API ecosystem.\nExploitation requires the attacker to possess valid authentication credentials within the target environment, after which they can leverage the lack of server-side authorization checks to perform unauthorized data exfiltration.",
  "technicalDetails": "The vulnerability is identified as a Broken Object-Level Authorization (BOLA) flaw within the IBM API Connect platform, specifically impacting versions 12.1.0.0 through 12.1.1.2.\nAt its core, the issue stems from an improper implementation of access control logic at the object level within the API layer.\nWhen an authenticated user initiates a request for a specific resource, the API layer fails to perform a comprehensive validation check to verify that the requesting user's security context possesses the requisite authorization to interact with the target object ID.\nThe attack flow proceeds as follows: An authenticated attacker observes the structure of API requests—typically involving resource-specific identifiers such as UUIDs, sequential integers, or slugs within the URL path or query parameters.\nBy systematically modifying or substituting these identifiers—a technique commonly known as 'ID harvesting' or 'Insecure Direct Object Reference (IDOR) manipulation'—the attacker can craft requests that target resources outside their assigned scope.\nBecause the backend components of IBM API Connect fail to cross-reference the user's session-based privileges against the ownership metadata of the requested resource, the system process erroneously grants access to the data.\nThis allows the attacker to retrieve sensitive information that should be protected by the platform's security policy.\nThe vulnerability is limited to authenticated users; however, the level of privilege required is generally standard user access, meaning no administrative elevation is necessary to exploit the object-level flaw.\nThe exposure is network-based, as the API endpoints are reachable over the network via standard HTTP/HTTPS protocols.\nThe impact post-exploitation is the unauthorized disclosure of sensitive data, which can lead to further reconnaissance or full-scale information leakage depending on the sensitivity of the data handled by the specific API endpoints.\nThe deficiency resides in the application's authorization logic, which fails to enforce per-object access controls consistently during the request-response lifecycle."
}