{"id":"CVE-2026-16715","kind":"vulnerability","aliases":["CVE-2026-16715"],"related":[],"title":"IBM API Connect: authenticated users can read other tenants' data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object ownership, so a logged-in user can read sensitive information belonging to other tenants. The attacker needs a valid account on the affected platform, and the flaw is reachable over the network.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","multi-tenant","self-hosted","vendor"],"not_affected_if":["no-untrusted-accounts","single-tenant","unaffected-version"],"how_to_check":"Find your API Connect version (admin/Cloud Manager about page or your deployment's version info) and compare: affected are 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3. Any tenant with a valid user account is a potential attacker, so multi-tenant setups matter most.","fix":"Upgrade to 10.0.8.13 (10.0.8 line) or v12.1.1.3 (v12 line). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:20+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:52:01+00:00","updated_at":"2026-11-07T06:27:22+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:52:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can read other tenants' data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object ownership, so a logged-in user can read sensitive information belonging to other tenants. The attacker needs a valid account on the affected platform, and the flaw is reachable over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","multi-tenant","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads other tenants' sensitive data","analyst_note":"Find IBM's security bulletin for CVE-2026-16715 to confirm the fixed versions and affected endpoints; the NVD entry alone does not state a fix.","how_to_check":"- Confirm whether you run IBM API Connect and note the version, for example with `apic version` or the admin console's about page (command unverified by sources).\n- Check whether the installed version falls in `10.0.8.0` to `10.0.8.12` or `12.1.0.0` to `12.1.1.2`.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","single-tenant"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, especially multi-tenant deployments where several teams or customers share one instance. Single-tenant deployments where only one party holds accounts have less exposure. The sources do not describe the specific endpoints involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4231,"output_tokens":611,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-16715 to confirm the fixed versions and affected endpoints; the NVD entry alone does not state a fix.","search":"'-16715':13A,16A '-2026':12A,15A '10.0.8.0':46B,93C '10.0.8.12':48B,95C '12.1.0.0':50B,97C '12.1.1.2':52B,99C 'account':77B 'affect':80B 'allow':101C 'api':2A,18A,21A,26B,33B,43B,91C 'api-gateway':25B 'attack':73B,105C 'auth':29B 'auth-requir':28B 'authent':4A,104C 'author':119C 'belong':68B 'broken':115C 'check':55B 'connect':3A,19A,22A,34B,44B,92C 'could':100C 'cve':11A,14A 'data':10A 'due':113C 'fail':53B 'flaw':84B 'gateway':27B 'host':40B 'ibm':1A,17A,20A,32B,42B,90C 'ibm-api-connect':31B 'inform':67B,109C 'level':118C 'log':61B 'logged-in':60B 'multi':36B 'multi-ten':35B 'need':74B 'network':89B 'object':56B,117C 'object-level':116C 'obtain':107C 'onprem':24A 'ownership':57B 'platform':81B 'reachabl':86B 'read':7A,65B 'remot':103C 'requir':30B 'self':39B 'self-host':38B 'sensit':66B,108C 'tenant':9A,37B,71B,112C 'user':5A,63B 'v12':23A 'valid':76B 'vendor':41B 'version':45B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0-10.0.8.12 or v12 on-prem 12.1.0.0-12.1.1.2. Any logged-in user can read sensitive data from other tenants (broken object-level authorization), so shared multi-tenant or multi-organization installs are most exposed. Single-tenant installs where every account is trusted have lower risk, but should still upgrade.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:27:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2077},"products":{"at":"2026-11-07T06:27:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2077},"workarounds":{"at":"2026-11-07T06:27:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2077},"who_affected":{"at":"2026-11-07T06:27:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2077}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","authrequired","high","ibmapiconnect","multitenant","selfhosted","vendor"],"campaign_type":null,"search_a":"'-16715':13A,16A '-2026':12A,15A 'api':2A,18A,21A 'authent':4A 'connect':3A,19A,22A 'cve':11A,14A 'data':10A 'ibm':1A,17A,20A 'onprem':24A 'read':7A 'tenant':9A 'user':5A 'v12':23A","search_b":"'10.0.8.0':46B '10.0.8.12':48B '12.1.0.0':50B '12.1.1.2':52B 'account':77B 'affect':80B 'api':26B,33B,43B 'api-gateway':25B 'attack':73B 'auth':29B 'auth-requir':28B 'belong':68B 'check':55B 'connect':34B,44B 'fail':53B 'flaw':84B 'gateway':27B 'host':40B 'ibm':32B,42B 'ibm-api-connect':31B 'inform':67B 'log':61B 'logged-in':60B 'multi':36B 'multi-ten':35B 'need':74B 'network':89B 'object':56B 'ownership':57B 'platform':81B 'reachabl':86B 'read':65B 'requir':30B 'self':39B 'self-host':38B 'sensit':66B 'tenant':37B,71B 'user':63B 'valid':76B 'vendor':41B 'version':45B","search_c":"'10.0.8.0':93C '10.0.8.12':95C '12.1.0.0':97C '12.1.1.2':99C 'allow':101C 'api':91C 'attack':105C 'authent':104C 'author':119C 'broken':115C 'connect':92C 'could':100C 'due':113C 'ibm':90C 'inform':109C 'level':118C 'object':117C 'object-level':116C 'obtain':107C 'remot':103C 'sensit':108C 'tenant':112C","first_public_at":"2026-11-07T05:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16715","severity":null,"published_at":"2026-11-07T05:18:20+00:00","modified_at":"2026-11-07T05:18:20+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16715:2077","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:27:22+00:00","modified_at":"2026-11-07T06:27:22+00:00","first_seen_at":"2026-11-07T06:27:22+00:00","fetched_at":"2026-11-07T06:27:22+00:00","note":"Confirmed in two IBM bulletins (…-api-connect-41 for 10.0.8.13, …-api-connect-39 for v12.1.1.3): CWE-639 BOLA, CVSS 7.7, no workarounds. No exploitation or PoC found; not searched on X (B tier).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}