Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-07T05:18:45.287Z",
  "pubdate": "2026-11-07T05:18:45.287Z",
  "executiveSummary": "A path traversal vulnerability exists in IBM API Connect, affecting versions 12.1.0.0 through 12.1.1.2. This vulnerability permits a remote, authenticated attacker to bypass multi-tenancy logical isolation, enabling unauthorized access to, or deletion of, resources belonging to other tenants.\nThe flaw stems from insufficient validation of user-supplied input used in file system or resource path construction. By manipulating path parameters, an attacker can traverse outside their assigned directory or scope to access sensitive data or perform administrative actions on cross-tenant resources.\nThe impact is severe, as it facilitates a breach of data confidentiality and integrity within a multi-tenant environment. Successful exploitation requires the attacker to possess authenticated access to the API Connect platform. The risk is significant, as it fundamentally undermines the security boundaries established between distinct tenants, potentially leading to unauthorized data exposure or malicious disruption of services.",
  "technicalDetails": "The vulnerability is identified as a path traversal flaw residing within the resource management interface of IBM API Connect versions 12.1.0.0 through 12.1.1.2. Path traversal (CWE-22) occurs when an application utilizes unsanitized or insufficiently validated user-supplied input to construct a file system path or internal resource path, failing to properly neutralize special characters, such as directory traversal sequences (e.g., '../').\nIn the context of IBM API Connect, the vulnerable component fails to enforce strict boundaries between tenant-specific storage or API resource namespaces. When an authenticated user submits a request containing manipulated path parameters, the application does not verify if the requested resource identifier corresponds to the authenticated tenant's scope. Instead, the backend processes the path relative to the root directory, allowing the traversal sequences to escape the intended directory structure.\nThe attack flow proceeds as follows: First, the attacker authenticates to the IBM API Connect platform, fulfilling the requirement for authenticated access. Second, the attacker identifies an API endpoint or management function that accepts path information as an input parameter. Third, the attacker crafts a malicious request containing directory traversal sequences, such as '../', designed to escape the current tenant's directory and point to an arbitrary directory or resource belonging to a target tenant. Finally, the server-side logic processes this path without adequate validation, resolving the path to the victim's resource.\nUpon successful traversal, the application treats the attacker's request as legitimate, granting the attacker the ability to access, modify, or delete resources outside their authorized context. This allows an attacker to perform unauthorized cross-tenant operations, including the retrieval of sensitive API definitions, configuration data, or the deletion of resources owned by other tenants on the same instance. The exploitation does not necessarily require elevated administrative privileges, provided the attacker has valid credentials on the platform, making this a critical authorization bypass issue within the multi-tenancy model."
}