Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:52.323Z",
  "pubdate": "2026-11-07T05:18:52.323Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical vulnerability categorized as Broken Object-Level Authorization (BOLA), also referred to as Insecure Direct Object Reference (IDOR).\nThis flaw resides within the multi-tenant architecture of the platform, specifically affecting how authorization checks are enforced when accessing resources.\nA remote authenticated attacker can leverage this vulnerability to bypass tenant isolation boundaries, resulting in unauthorized access to sensitive information belonging to other tenants.\nThe risk is significant due to the potential for cross-tenant data exposure, which compromises the integrity and confidentiality of the API management environment.\nExploitation requires the attacker to possess valid credentials within the system; however, they do not require administrative privileges to target data belonging to other organizations or tenants sharing the same infrastructure.\nOrganizations using the identified versions are at risk of data leakage and should prioritize remediation efforts.",
  "technicalDetails": "The vulnerability stems from improper authorization validation during object-level requests within the IBM API Connect software suite. Specifically, the API gateway or management interface fails to adequately verify that the authenticated requester holds the necessary authorization to access, view, or manipulate objects associated with a different tenant ID.\nIn a multi-tenant environment, the backend system is expected to perform a granular check for every incoming request, ensuring that the 'tenant_id' or 'org_id' context associated with the user session matches the requested resource. The root cause is a failure in the application logic to validate these ownership constraints at the API endpoint level.\nThe attack flow typically involves an attacker observing legitimate API requests sent to the management plane or gateway. By identifying parameters that map to specific resources—such as URIs containing unique identifiers like UUIDs or numeric indices—an attacker can attempt to manipulate these identifiers. By replacing their own valid identifier with one belonging to a different tenant, the attacker sends a request to the backend service.\nBecause the server-side logic fails to cross-reference the object's ownership against the authenticated subject's security context, the server proceeds to process the request as if it were a legitimate access attempt within the same tenant scope. This allows the attacker to retrieve, and potentially modify, sensitive configuration data, API keys, client information, or usage analytics belonging to disparate tenants.\nThe attack is characterized as a remote, authenticated exploitation. The attacker must possess an active account within the target IBM API Connect instance, but the flaw does not necessitate specialized escalation of privileges. The vulnerability persists across the specified versions of the 10.x and 12.x branches, indicating a systemic flaw in the authorization middleware or object-handling logic employed by the product. Post-exploitation impact includes unauthorized data exfiltration, breach of confidentiality, and potential operational disruption if configuration settings are inadvertently or maliciously modified."
}