Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:51.370Z",
  "pubdate": "2026-11-07T05:18:51.370Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists in specific versions of IBM API Connect, allowing remote authenticated attackers to bypass intended access controls.\nThe vulnerability resides in the authorization logic, where the system fails to adequately validate if the requesting user possesses the necessary permissions to access specific object instances.\nBy manipulating object identifiers in API requests, an authenticated attacker can retrieve sensitive information belonging to other users or system entities that should be restricted.\nThis flaw affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe risk implication is significant, as it leads to unauthorized information disclosure, potentially exposing proprietary data, configuration details, or sensitive user information stored within the API management platform.\nExploitation requires the attacker to be authenticated to the target API Connect environment; however, no elevated privileges beyond standard user access are inherently required to target vulnerable objects if the underlying access control checks are absent.",
  "technicalDetails": "The core vulnerability is identified as a Broken Object-Level Authorization (BOLA) flaw, categorized under the broader umbrella of insecure direct object references or improper access control mechanisms.\nIn IBM API Connect, various resources and configuration objects are accessed via API endpoints that utilize specific identifiers, such as object IDs, UUIDs, or primary keys, within the request path or parameters.\nThe vulnerability occurs because the application fails to perform a granular authorization check on the back end for every request involving a specific object identifier. While the initial authentication process confirms the user's identity, the authorization layer fails to verify if the authenticated session token is associated with the requested resource identifier.\nAn attacker can exploit this by intercepting and inspecting legitimate API calls to identify the pattern of object ID usage. By systematically changing or enumerating the object identifiers within these requests, the attacker can submit crafted requests to the API server.\nBecause the server lacks a robust 'ownership' or 'permission' validation check for the requested object, it processes the request as if the attacker were the authorized owner of that specific resource. Consequently, the API returns sensitive object data that should have been restricted to the legitimate owner or system administrators.\nThis vulnerability is particularly critical because it bypasses the security layer that enforces data isolation between different tenants or users within the API Connect ecosystem. Since the vulnerability is located within the request-handling logic of the API endpoints, the scope of the impact can be extensive, potentially allowing unauthorized data scraping or information exposure across multiple objects managed by the platform.\nAuthentication is a prerequisite for exploitation, as the attacker must possess a valid session token to interact with the API endpoints. Once authenticated, the attacker does not require administrative rights; they only need the ability to perform standard GET or read operations against the exposed objects. The exposure is network-based, specifically targeting the management or administrative API interfaces exposed by the vulnerable IBM API Connect deployment.\nThe post-exploitation impact involves the retrieval of sensitive system or user information, which can be further leveraged to perform reconnaissance, identity theft, or unauthorized configuration modifications depending on the nature of the data exposed through the vulnerable object endpoints."
}