Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-07T04:17:29.070Z",
  "pubdate": "2026-11-07T04:17:29.070Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an improper authorization vulnerability. This security flaw allows a remote, unauthenticated or unauthorized attacker to perform administrative operations, specifically the creation, modification, or deletion of tenants within the platform.\nThe vulnerability resides in the tenant management interface of the API Connect product. By exploiting the lack of robust access control checks, an attacker can bypass security boundaries to manipulate tenant configurations. This capability poses a significant risk to the integrity and confidentiality of the entire multi-tenant environment.\nThe primary impact involves unauthorized administrative control, which could lead to service disruption, data isolation bypass, or the total compromise of tenant environments. The exploit requires network access to the API Connect management interfaces. Organizations utilizing affected versions are at high risk, as this vulnerability enables unauthorized actors to interfere with the multi-tenancy architecture, potentially leading to unauthorized data access or complete system unavailability for affected customers.",
  "technicalDetails": "The vulnerability originates from a failure in the authorization layer of IBM API Connect, specifically during the handling of tenant management requests. Within the affected versions, the API endpoints responsible for lifecycle operations—such as creating, modifying, or deleting tenants—do not strictly enforce the mandatory authorization checks required to verify if the requester possesses the necessary administrative privileges to perform these sensitive actions.\nThe root cause is a deficiency in the access control mechanism, where the application fails to validate the identity and associated privileges of the user before executing the requested backend logic. Consequently, the application assumes that any request directed at these administrative functions originates from a trusted and authorized source.\nThe exploitation flow proceeds as follows: A remote attacker identifies the specific API endpoints responsible for tenant orchestration within the IBM API Connect platform. By constructing and transmitting specially crafted HTTP requests to these endpoints, the attacker attempts to invoke management functions. Because the system lacks the proper server-side authorization check, it processes the attacker's request as legitimate. The attacker can successfully execute administrative commands, including the deletion of existing tenant infrastructure, the modification of tenant-specific configurations, or the provisioning of unauthorized new tenants.\nThe scope of impact is severe, as it permits full lifecycle control over tenants by non-privileged or remote entities. This allows for the manipulation of tenant environments without being constrained by the standard role-based access control (RBAC) policies intended for the product. The lack of validation creates a direct vector for unauthorized administrative actions across the entire multi-tenant deployment, potentially resulting in complete environment teardown, the unauthorized introduction of new tenant structures for exfiltration or persistence, and the disruption of multi-tenant service level agreements.\nThe vulnerability is exposed through the network interfaces that handle administrative traffic, requiring no prior authentication or specific credentials to trigger the flawed logic. This makes the system susceptible to remote exploitation where the attacker can issue commands via standard RESTful API interactions targeting the management interface, effectively bypassing the security controls designed to isolate and protect tenant administrative operations."
}