Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-07T05:18:53.060Z",
  "pubdate": "2026-11-07T05:18:53.060Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object-Level Authorization (BOLA) vulnerability.\nThis flaw resides within the API management interface, allowing a remote authenticated attacker to access, modify, or disclose sensitive information by manipulating object identifiers.\nThe vulnerability occurs because the application fails to perform adequate server-side authorization checks on resources requested via API endpoints.\nBy targeting specific object IDs, an attacker can bypass intended access controls to retrieve data belonging to other users or system entities, leading to unauthorized data exposure.\nThe risk is categorized as high, as it grants authenticated attackers access to sensitive business or operational data that should be strictly protected.\nSuccessful exploitation requires the attacker to possess a valid authentication session, after which they can perform object-level manipulation without further privileges.",
  "technicalDetails": "The vulnerability is a classic Broken Object-Level Authorization (BOLA), often classified under CWE-285 or CWE-639, where the application's backend logic fails to validate the authorization context of an object before servicing an API request.\nIn IBM API Connect, the affected components manage API configurations, policies, or administrative objects. When a request is made to access a specific resource—typically represented by an ID in the URL path or body (e.g., /api/resources/{id})—the application assumes that the presence of a valid authentication token is sufficient to authorize the request.\nThe root cause is the reliance on client-provided identifiers for resource access without implementing a secondary authorization layer that checks if the currently authenticated user has explicit permission to interact with the requested object ID.\nThe attack flow proceeds as follows: First, an attacker establishes a legitimate session with the IBM API Connect platform. Second, the attacker observes the application's REST API traffic to identify resource endpoints that utilize sequential or predictable object identifiers. Third, the attacker initiates a crafted request targeting a resource ID belonging to another user or administrative entity. Finally, because the server-side logic lacks an authorization check (e.g., verifying ownership or 'has_access' permissions), the API returns the requested object's data to the attacker.\nThe impact of this BOLA vulnerability is significant, as it enables the unauthorized retrieval of sensitive information. This may include API keys, internal configuration details, user profiles, or other proprietary metadata stored within the API management system. Because the vulnerability exists at the object level, an attacker could potentially iterate through identifier values to harvest bulk data, leading to large-scale data exfiltration.\nThis vulnerability is particularly dangerous in environments where multiple tenants or users share the same infrastructure, as it breaks the logical isolation between those users' datasets. There are no specific complex payload requirements; the attacker simply provides an alternative, authorized identifier that does not belong to their own account. The exposure is network-wide for any reachable API Connect management interface."
}