Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:50.430Z",
  "pubdate": "2026-11-07T05:18:50.430Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw within IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe security defect permits a remote authenticated attacker to bypass intended access control restrictions and retrieve sensitive information to which they should not have access.\nBy successfully exploiting this authorization bypass, an attacker can gain unauthorized visibility into protected resources or configuration data managed by the API Connect platform.\nThe risk is categorized as significant because it undermines the principle of least privilege, potentially exposing backend API metadata, client credentials, or sensitive service definitions.\nExploitation requires the attacker to have an existing authenticated session within the platform, though it does not necessitate administrative privileges.\nGiven the central role IBM API Connect plays in managing enterprise API lifecycles, this vulnerability represents a critical risk to data confidentiality and integrity across the integrated service ecosystem.",
  "technicalDetails": "The vulnerability resides in the access control logic governing how IBM API Connect evaluates authorization requests for specific system resources or management endpoints.\nThe root cause is identified as an improper authorization mechanism, where the application fails to adequately validate the scope or permissions associated with an authenticated user's request context before returning sensitive information.\nIn a standard deployment of IBM API Connect, the platform enforces granular access control lists (ACLs) to segregate administrative, developer, and consumer roles. The defect exists where the authorization boundary fails during the processing of specific API calls or management tasks.\nAn attacker can exploit this by crafting requests to resources that the backend logic incorrectly assumes are public or sufficiently protected by session authentication alone, disregarding the specific authorization requirements for the target data.\nThe attack flow begins with an authenticated attacker gaining access to the platform. Once authenticated, the attacker identifies specific API endpoints or management functions that do not perform sufficient permission checks on the server side.\nBy manipulating request parameters or URI paths, the attacker bypasses the internal authorization checks intended to restrict access to sensitive datasets.\nBecause the server-side component fails to verify whether the authenticated user possesses the 'owner' or 'authorized reader' attribute for the requested object, it processes the request and returns the sensitive data in the HTTP response body.\nThis behavior can lead to unauthorized data exfiltration, including the disclosure of API keys, client secrets, endpoint definitions, and environment-specific configuration details.\nThe issue affects the management plane and associated API surfaces of IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The lack of validation occurs within the internal request handling logic that precedes the return of object metadata.\nPost-exploitation, the attacker may use the acquired sensitive information to perform reconnaissance, escalate privileges within the platform, or facilitate downstream attacks against backend services that rely on the credentials exposed through this vulnerability."
}