Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:53.253Z",
  "pubdate": "2026-11-07T05:18:53.253Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists within IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThis vulnerability allows a remote authenticated attacker to bypass standard access controls and retrieve sensitive information that they are not authorized to access.\nThe flaw resides in the handling of object-level requests, where the system fails to verify whether the authenticated user has appropriate permissions to perform operations on specific objects.\nThe impact involves potential unauthorized disclosure of private data, metadata, or sensitive configuration details stored within the API management platform.\nExploitation requires the attacker to possess a valid authentication session, as the flaw specifically pertains to authorization logic once inside the application environment.\nGiven the nature of API Connect as a gateway to enterprise data, successful exploitation may lead to unauthorized data exposure, facilitating further attacks or the exfiltration of sensitive organizational assets.\nOrganizations using the specified versions are at risk of privilege escalation at the data layer, necessitating immediate review of access controls and security updates.",
  "technicalDetails": "The vulnerability is rooted in a failure to perform adequate authorization checks at the object level within IBM API Connect's request handling pipeline. In a secure implementation, an API should validate that the authenticated user's session identifier is explicitly permitted to interact with the specific object identifier (ID) or resource path requested. This vulnerability indicates that while the system validates the session authenticity, it incorrectly assumes that any authenticated user may perform operations on objects provided via input parameters.\nThe attack flow begins with a remote, authenticated user identifying an API endpoint that references object-specific resources, typically identified via URI parameters, header identifiers, or body content. By systematically enumerating these identifiers—a process often referred to as 'Insecure Direct Object Reference' (IDOR) or BOLA—the attacker can craft requests targeting objects belonging to other users or sensitive system resources.\nBecause the server-side logic processes these requests without verifying the relationship between the authenticated user and the requested resource, the API effectively grants access to protected objects. The vulnerable component is the underlying authorization middleware responsible for mediating user-to-object interactions within the API Connect ecosystem.\nSuccessful exploitation allows for the leakage of sensitive information that should be logically siloed. This could include, but is not limited to, private API configurations, secret keys, or customer-specific payload data processed through the gateway. The scope of the information disclosure depends on the specific objects accessible through the compromised endpoints.\nThe vulnerability is present in versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The lack of granular authorization logic ensures that even with a low-privileged account, an attacker can traverse the object tree if the IDs are predictable or discoverable. There is no requirement for high-level administrative privileges; basic authentication is sufficient to trigger the flaw, as the application assumes that authenticated users are inherently trustworthy for all accessible resource IDs.\nPost-exploitation, an attacker can continuously harvest sensitive data. Since the attack occurs at the API layer, it may evade traditional perimeter defenses that focus on SQL injection or cross-site scripting (XSS), as the traffic patterns appear as legitimate, authenticated API calls. Mitigation requires fixing the authorization checks to ensure each request explicitly validates user-to-resource ownership before returning content."
}