Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-11-07T05:18:54.617Z",
  "pubdate": "2026-11-07T05:18:54.617Z",
  "executiveSummary": "This vulnerability involves Improperly Controlled Modification of Object Attributes within IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe flaw allows a remote authenticated attacker to influence access-related object attributes that are intended to be strictly governed by system-level controls.\nSuccessful exploitation results in unauthorized information disclosure, as the manipulated attributes can alter access control enforcement mechanisms to expose sensitive data.\nThe risk is categorized as significant because it allows authenticated users to bypass security configurations through attribute injection or modification.\nThe primary requirement for exploitation is that the attacker must have valid authentication to the affected API Connect environment.\nThis issue highlights a critical failure in the validation of user-supplied input when updating object states, potentially undermining the integrity of the platform's security model.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and insecure object attribute management during update or configuration operations within the IBM API Connect framework.\nThe root cause is identified as an Improperly Controlled Modification of Object Attributes, which permits an authenticated user to provide values that directly influence backend security configurations or sensitive object properties.\nIn the vulnerable versions—10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2—the application fails to strictly differentiate between user-modifiable data and system-critical security attributes during request processing.\nThe attack flow initiates when an authenticated user sends a crafted request to an API endpoint or management interface that handles object attribute updates. By injecting malicious values into specific fields, the attacker coerces the system to modify access-related settings that should be immutable or restricted to administrative roles.\nBecause the application logic does not properly sanitize or filter the input against authorized attribute maps, the underlying object is updated with the attacker-supplied configuration. This subverts the intended security policy governing data access.\nOnce the sensitive object attribute is modified, the attacker can leverage the altered state to gain read access to data they are not authorized to view. The payload essentially acts as an escalation of privileges, allowing the actor to bypass standard access control lists (ACLs) or role-based access control (RBAC) restrictions by altering the enforcement parameters associated with the object.\nThe vulnerability is restricted to authenticated sessions, meaning an attacker must possess valid credentials to access the environment. However, the impact of the exploitation is significant, as it effectively nullifies the security constraints applied to sensitive system resources. The exposure is persistent until the attribute is reverted or the system is reconfigured by a legitimate administrator.\nThere is no evidence of remote code execution or direct system compromise; rather, the impact is strictly centered on the unauthorized disclosure of sensitive information through the degradation of attribute-based security controls."
}