Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:50.613Z",
  "pubdate": "2026-11-07T05:18:50.613Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability has been identified in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis vulnerability allows a remote, authenticated attacker to bypass authorization controls and access sensitive information that they are not authorized to view.\nThe flaw stems from improper validation of object-level permissions, enabling attackers to interact with resources by manipulating object identifiers in API requests.\nThe impact is significant, as it leads to unauthorized data disclosure and potential exposure of sensitive organizational or user information.\nSuccessful exploitation requires the attacker to have an active authenticated session within the system, though the specific permissions of that account are insufficient for the accessed resources.\nThis risk highlights a failure in the application's authorization layer to verify that the requesting entity has appropriate ownership or access rights to the specific object referenced in the URI or payload.\nOrganizations using the specified versions of IBM API Connect are at risk of data breaches through unauthorized API exploitation.",
  "technicalDetails": "The vulnerability is classified as a Broken Object-Level Authorization (BOLA), also referred to as Insecure Direct Object Reference (IDOR). The root cause lies in the application's failure to perform granular, identity-based authorization checks before serving resources requested by an authenticated user.\nIn IBM API Connect, specific API endpoints interact with backend objects via unique identifiers (e.g., UUIDs, record IDs) embedded in the URL path or request body. When an authenticated user submits a request for a specific object, the backend service fails to verify whether the requester maintains the necessary ownership, permissions, or access control list (ACL) rights to the requested object.\nThe attack flow proceeds as follows: First, the attacker establishes a legitimate, authenticated session within the IBM API Connect environment. Second, the attacker discovers the pattern of object identifiers used by the API, often through reconnaissance of legitimate traffic or predictable naming conventions. Third, the attacker crafts a malicious request—typically a GET or similar retrieval operation—by substituting the identifier of a target resource they are not authorized to view. Because the application logic relies on authentication (being a logged-in user) rather than authorization (having rights to the specific resource), the server processes the request and returns the sensitive data associated with the unauthorized object identifier.\nThe vulnerable components are the API management and gateway services that handle resource orchestration. Because the vulnerability is inherent to the authorization logic of these services, it bypasses traditional security perimeters that only validate the user's login state.\nThis vulnerability is particularly critical because it requires no escalation of privileges beyond basic authentication, yet it provides full access to sensitive records. The exposure is network-accessible to any remote authenticated user. The post-exploitation impact includes unauthorized exfiltration of sensitive information, potentially leading to mass data disclosure depending on the attacker's ability to iterate through resource identifiers.\nThe vulnerability is confirmed in IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2. Defensive mechanisms such as proper enforcement of row-level security or backend authorization logic are currently insufficient or absent in these versions when processing requests for specific object identifiers."
}