{"id":"CVE-2026-16716","kind":"vulnerability","aliases":["CVE-2026-16716"],"related":[],"title":"IBM API Connect: authenticated users can bypass restrictions and modify sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly restrict how security tokens are assigned. A remote attacker with a valid account can bypass security restrictions to read and modify sensitive information.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13","12.1.1.3"],"affected":"10.0.8.0 - 10.0.8.12; 12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["auth-required","version-outside-affected-ranges"],"how_to_check":"Check your API Connect version. Exposed if it is 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2. Fixed in 10.0.8.13 and 12.1.1.3. The attacker needs a valid account.","fix":"Upgrade IBM API Connect V10.0.8 to 10.0.8.13 (IBM bulletin). For V12.1, the CVE record's vendor solution says upgrade to 12.1.1.3 (not stated in the bulletin text I read).","status":"open","published_at":"2026-11-07T05:18:20+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:48:47+00:00","updated_at":"2026-11-07T06:26:14+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-07T05:48:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can bypass restrictions and modify sensitive data","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly restrict how security tokens are assigned. A remote attacker with a valid account can bypass security restrictions to read and modify sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads and modifies sensitive information through bypassed restrictions","analyst_note":"Find IBM's security bulletin for CVE-2026-16716 to confirm fixed versions and any configuration prerequisites.","how_to_check":"- Check the installed API Connect version in the product's admin console or deployment configuration against the affected ranges: `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`.\n- unknown for any further check, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed, and the attacker needs a valid account on the platform. Deployments outside those ranges are not affected by this description. The sources do not say which features or configurations are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4239,"output_tokens":574,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-16716 to confirm fixed versions and any configuration prerequisites.","search":"'-16716':15A,18A '-2026':14A,17A '10.0.8.0':39B,75C '10.0.8.12':41B,77C '12.1.0.0':43B,79C '12.1.1.2':45B,81C 'access':93C 'account':61B 'allow':83C 'api':2A,19A,22B,29B,36B,73C 'api-gateway':21B 'assign':54B,105C 'attack':57B,87C 'auth':25B 'auth-requir':24B 'authent':4A,86C 'bypass':7A,63B,89C 'connect':3A,20A,30B,37B,74C 'could':82C 'cve':13A,16A 'data':12A 'due':98C 'gateway':23B 'host':33B 'ibm':1A,28B,35B,72C 'ibm-api-connect':27B 'improp':100C 'inform':71B,97C 'modifi':10A,69B,95C 'proper':48B 'read':67B 'remot':56B,85C 'requir':26B 'restrict':8A,49B,65B,91C,101C 'secur':51B,64B,90C,103C 'self':32B 'self-host':31B 'sensit':11A,70B,96C 'token':52B,104C 'user':5A 'valid':60B 'vendor':34B 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges are exposed, and the attacker needs a valid account on the platform. Deployments outside those ranges are not affected by this description. The sources do not say which features or configurations are required.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2076},"workarounds":{"at":"2026-11-07T06:26:14Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2076}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","connect"],"ptokens":["api","connect"],"labels":["apigateway","authrequired","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-16716':15A,18A '-2026':14A,17A 'api':2A,19A 'authent':4A 'bypass':7A 'connect':3A,20A 'cve':13A,16A 'data':12A 'ibm':1A 'modifi':10A 'restrict':8A 'sensit':11A 'user':5A","search_b":"'10.0.8.0':39B '10.0.8.12':41B '12.1.0.0':43B '12.1.1.2':45B 'account':61B 'api':22B,29B,36B 'api-gateway':21B 'assign':54B 'attack':57B 'auth':25B 'auth-requir':24B 'bypass':63B 'connect':30B,37B 'gateway':23B 'host':33B 'ibm':28B,35B 'ibm-api-connect':27B 'inform':71B 'modifi':69B 'proper':48B 'read':67B 'remot':56B 'requir':26B 'restrict':49B,65B 'secur':51B,64B 'self':32B 'self-host':31B 'sensit':70B 'token':52B 'valid':60B 'vendor':34B 'version':38B","search_c":"'10.0.8.0':75C '10.0.8.12':77C '12.1.0.0':79C '12.1.1.2':81C 'access':93C 'allow':83C 'api':73C 'assign':105C 'attack':87C 'authent':86C 'bypass':89C 'connect':74C 'could':82C 'due':98C 'ibm':72C 'improp':100C 'inform':97C 'modifi':95C 'remot':85C 'restrict':91C,101C 'secur':90C,103C 'sensit':96C 'token':104C","first_public_at":"2026-11-07T05:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16716","severity":null,"published_at":"2026-11-07T05:18:20+00:00","modified_at":"2026-11-07T05:18:20+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16716:2076","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:26:14+00:00","modified_at":"2026-11-07T06:26:14+00:00","first_seen_at":"2026-11-07T06:26:14+00:00","fetched_at":"2026-11-07T06:26:14+00:00","note":"IBM bulletin (api-connect-41, 2026-11-05) lists CVE-2026-16716 (CWE-1259, CVSS 8.8, AV:N/PR:L) with fix 10.0.8.13, workarounds None. Bulletin affected table covers only V10.0.8.0-12; the V12.1 range and 12.1.1.3 fix come from the CVE record (OpenCVE), not verified on IBM page. No exploitation or PoC found; social search not run (routine B).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://app.opencve.io/cve/CVE-2026-16716"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93501,"url":"https://app.opencve.io/cve/CVE-2026-16716","title":"OpenCVE CVE-2026-16716 (CNA record with 12.1.1.3 solution)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}