Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:50.997Z",
  "pubdate": "2026-11-07T05:18:50.997Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability enables a remote, authenticated attacker to bypass intended access controls and gain unauthorized access to sensitive information managed by the platform.\nThis flaw resides in the authorization logic applied to object requests, where the system fails to adequately verify that the authenticated user possesses the appropriate permissions to access or manipulate specific objects or data sets.\nSuccessful exploitation allows attackers to perform operations on resources they are not explicitly authorized to interact with, leading to significant information disclosure risks.\nThe impact includes the potential breach of sensitive API data or configuration details, compromising the confidentiality of the environment.\nExploitation requires the attacker to have valid authentication to the platform; however, once authenticated, no additional privileges are necessary to perform the unauthorized data retrieval.\nOrganizations relying on IBM API Connect in the specified version range should treat this as a high-priority security concern.",
  "technicalDetails": "The vulnerability is a Broken Object-Level Authorization (BOLA) flaw, categorized under the broader umbrella of insecure direct object references or missing function-level access control.\nIn IBM API Connect, the vulnerability occurs when the application accepts user-supplied identifiers (such as UUIDs, sequence numbers, or resource paths) within API requests without performing granular verification of ownership or access rights against the current session context.\nRoot Cause: The underlying issue lies in the validation layer of the API gateway or administrative interfaces. When an authenticated user submits a request to a resource endpoint, the system validates the session token for identity but fails to perform an authorization check to determine if the specific resource being requested belongs to the user or if the user possesses the required scoping roles to access that specific object ID.\nAttack Flow: An attacker with valid credentials initiates an API request targeting a specific resource ID. By manipulating the object identifier within the request URI or request body, the attacker attempts to access resources belonging to other users or sensitive administrative objects. Because the back-end logic trusts the object identifier without re-verifying the relationship between the authenticated subject and the targeted object, the application returns the sensitive data associated with the requested ID.\nAffected Components: The issue impacts the API Management and Gateway components of IBM API Connect. The vulnerability effectively turns legitimate API functionality into an unintended data exfiltration vector.\nAuthentication/Authorization: The vulnerability is strictly an authorization bypass. While authentication is a prerequisite, it does not mitigate the risk, as the internal logic fails to differentiate between authorized and unauthorized object access once the session is established.\nExploitation Methodology: The attacker identifies internal object identifiers through observation or enumeration. By iterating through these identifiers or guessing target resources, the attacker can systematically harvest information that should be logically isolated. The request flow essentially bypasses the intended boundary checks, treating an authenticated user as a global administrator for the scope of the affected resource.\nImpact: The post-exploitation result is the unauthorized disclosure of sensitive information. This may involve the exfiltration of API definitions, private data records, or metadata that is otherwise restricted. Given the nature of IBM API Connect as an integration and management middleware, this vulnerability can expose complex inter-service configurations, potentially facilitating further lateral movement or deeper system compromises within the API ecosystem."
}