Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:50.800Z",
  "pubdate": "2026-11-07T05:18:50.800Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability allows a remote, authenticated attacker to bypass authorization controls and access sensitive information that should otherwise be restricted.\nThe flaw stems from the application relying on client-supplied data to make authorization decisions, rather than verifying access rights server-side against a secure identity context.\nSuccessful exploitation grants an attacker unauthorized access to sensitive data, potentially leading to a breach of confidentiality.\nThe risk is categorized as significant because it allows authenticated users to escalate their access scope or view data belonging to other entities or resources they are not permitted to access.\nRemediation requires applying the necessary patches provided by IBM to enforce robust, server-side authorization checks.",
  "technicalDetails": "The core of this vulnerability lies in an improper authorization mechanism within the request processing pipeline of IBM API Connect. The system architecture improperly defers the responsibility of defining access scope to the client by trusting information supplied directly within the client request, rather than performing an independent, authoritative lookup of the user's permissions and access context on the server side.\nIn a secure configuration, authorization decisions must be computed on the server using trusted identity tokens and internal access control lists (ACLs). In the affected versions of IBM API Connect, the application fails to validate the integrity or the legitimacy of the client-supplied information used to inform authorization logic. This deviation from standard security practices creates a flaw where an authenticated user can manipulate inputs—such as identifiers or scoped parameters—to deceive the authorization engine into granting access to unauthorized resources.\nThe exploitation flow follows these steps: 1) The attacker authenticates legitimately to the IBM API Connect environment, establishing a valid session. 2) The attacker identifies API calls where authorization logic relies on client-supplied parameters (e.g., resource IDs, organization contexts, or scope headers). 3) The attacker crafts a request, modifying these parameters to represent a target resource or sensitive data set to which they do not have legitimate access. 4) The application processes the request, incorrectly trusts the manipulated client-supplied data, and fails to reconcile the request against the authenticated user's actual permissions. 5) The server returns the requested sensitive information to the attacker, bypassing the intended authorization controls.\nBecause the vulnerability requires the attacker to be authenticated, it is classified as an improper authorization issue rather than an unauthenticated access vulnerability. However, the impact is severe, as it facilitates unauthorized lateral movement or information disclosure within the API management layer. The vulnerability affects the core authorization logic, likely residing in the gateway or management service components responsible for evaluating incoming requests. There is no requirement for high-level administrative privileges; a standard authenticated user account may be sufficient to leverage this flaw, provided the user can craft requests that target unauthorized but accessible backend resources."
}