{"id":"CVE-2026-16717","kind":"vulnerability","aliases":["CVE-2026-16717"],"related":[],"title":"IBM API Connect V12 OnPrem 12.1.0.0-12.1.1.2: authenticated users can read other users' objects; fixed in 12.1.1.3","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have a broken object-level authorization flaw. A logged-in user can request objects they do not own and obtain sensitive information.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["outside-affected-version-range","unaffected-version"],"how_to_check":"Check the installed API Connect V12 OnPrem version; affected are v12.1.0.0 to v12.1.1.2, fixed in v12.1.1.3. IBM's bulletin does not name the vulnerable endpoint. The 10.0.8.x stream is not listed for this CVE in the bulletin.","fix":"Upgrade to IBM API Connect v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:21+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:50:54+00:00","updated_at":"2026-11-07T06:26:16+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can read sensitive data they should not see","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have a broken object-level authorization flaw. A logged-in user can request objects they do not own and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads sensitive information belonging to other objects","analyst_note":"Check IBM's security bulletin for API Connect 12.1 for the fixed version and affected components; NVD alone gives no fix.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` to `12.1.1.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-version-range"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 are exposed, since an attacker needs a valid account on the platform. The sources do not say which API Connect components or roles are affected, so the exact exposure is unknown. Teams not running this version range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4194,"output_tokens":505,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for API Connect 12.1 for the fixed version and affected components; NVD alone gives no fix.","search":"'-16717':20A,23A '-2026':19A,22A '12.1.0.0':6A,43B,73C '12.1.1.2':7A,45B,75C '12.1.1.3':17A 'allow':77C 'api':2A,24A,29B,33B,40B,71C 'api-gateway':28B 'attack':81C 'authent':8A,80C 'author':52B,92C 'broken':48B,88C 'connect':3A,25A,34B,41B,72C 'could':76C 'cve':18A,21A 'due':86C 'fix':15A 'flaw':53B 'gateway':30B 'host':37B 'ibm':1A,32B,39B,70C 'ibm-api-connect':31B 'inform':69B,85C 'level':51B,91C 'log':56B 'logged-in':55B 'object':14A,50B,61B,90C 'object-level':49B,89C 'obtain':67B,83C 'onprem':5A,27A 'read':11A 'remot':79C 'request':60B 'self':36B 'self-host':35B 'sensit':68B,84C 'user':9A,13A,58B 'v12':4A,26A 'vendor':38B 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 where users have valid accounts. A logged-in user can request objects they do not own and read sensitive information (broken object-level authorization, CWE-639). Versions 12.1.1.3 and later, and the 10.0.8 stream (not listed for this CVE), can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:26:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2075},"products":{"at":"2026-11-07T06:26:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2075},"workarounds":{"at":"2026-11-07T06:26:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2075},"how_to_check":{"at":"2026-11-07T06:26:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2075},"who_affected":{"at":"2026-11-07T06:26:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2075}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-16717':20A,23A '-2026':19A,22A '12.1.0.0':6A '12.1.1.2':7A '12.1.1.3':17A 'api':2A,24A 'authent':8A 'connect':3A,25A 'cve':18A,21A 'fix':15A 'ibm':1A 'object':14A 'onprem':5A,27A 'read':11A 'user':9A,13A 'v12':4A,26A","search_b":"'12.1.0.0':43B '12.1.1.2':45B 'api':29B,33B,40B 'api-gateway':28B 'author':52B 'broken':48B 'connect':34B,41B 'flaw':53B 'gateway':30B 'host':37B 'ibm':32B,39B 'ibm-api-connect':31B 'inform':69B 'level':51B 'log':56B 'logged-in':55B 'object':50B,61B 'object-level':49B 'obtain':67B 'request':60B 'self':36B 'self-host':35B 'sensit':68B 'user':58B 'vendor':38B 'version':42B","search_c":"'12.1.0.0':73C '12.1.1.2':75C 'allow':77C 'api':71C 'attack':81C 'authent':80C 'author':92C 'broken':88C 'connect':72C 'could':76C 'due':86C 'ibm':70C 'inform':85C 'level':91C 'object':90C 'object-level':89C 'obtain':83C 'remot':79C 'sensit':84C","first_public_at":"2026-11-07T05:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16717","severity":null,"published_at":"2026-11-07T05:18:21+00:00","modified_at":"2026-11-07T05:18:21+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16717:2075","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:26:16+00:00","modified_at":"2026-11-07T06:26:16+00:00","first_seen_at":"2026-11-07T06:26:16+00:00","fetched_at":"2026-11-07T06:26:16+00:00","note":"Read IBM bulletin (-39): CVE-2026-16717 listed, CWE-639, CVSS 7.7; V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds None. Endpoint not named.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}