{"id":"CVE-2026-17112","kind":"vulnerability","aliases":["CVE-2026-17112"],"related":[],"title":"IBM API Connect: broken authorization exposes other tenants' sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level permissions. A logged-in user can read sensitive information that belongs to other tenants.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-management","ibm-api-connect","infrastructure","multi-tenant"],"not_affected_if":["outside-affected-versions","single-tenant"],"how_to_check":"Find your API Connect version (management console or product build info). Affected: 10.0.8.0 to 10.0.8.12, and V12 OnPrem 12.1.0.0 to 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3. Deployments with several tenants/provider organizations on one instance are the ones whose data can leak across tenants.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8 line) or v12.1.1.3 (v12 line). IBM lists no workaround or interim fix. v12 download: https://www.ibm.com/support/pages/node/7290205","status":"open","published_at":"2026-11-07T05:18:25+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:50:52+00:00","updated_at":"2026-11-07T06:25:23+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: broken authorization exposes other tenants' sensitive data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level permissions. A logged-in user can read sensitive information that belongs to other tenants.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","multi-tenant","api-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads other tenants' sensitive data","analyst_note":"Check the IBM security bulletin for this CVE for the fixed versions and affected API endpoints; NVD text alone gives no fix.","how_to_check":"- Confirm the installed API Connect version in the management console or product build information, and compare it with the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`.\n- Check whether the deployment runs multiple tenants or organizations on a shared instance.","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions","single-tenant"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, especially shared or multi-tenant deployments where separate teams or customers use the same instance. Single-tenant deployments on other versions are not in the stated ranges. The sources do not say which API calls are involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4234,"output_tokens":582,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed versions and affected API endpoints; NVD text alone gives no fix.","search":"'-17112':13A,16A '-2026':12A,15A '10.0.8.0':38B,69C '10.0.8.12':40B,71C '12.1.0.0':42B,73C '12.1.1.2':44B,75C 'allow':77C 'api':2A,17A,19A,24B,28B,35B,67C 'api-manag':23B 'attack':81C 'authent':80C 'author':5A,96C 'belong':62B,86C 'broken':4A,92C 'check':47B 'connect':3A,18A,20A,29B,36B,68C 'could':76C 'cve':11A,14A 'data':10A 'due':90C 'expos':6A 'fail':45B 'ibm':1A,27B,34B,66C 'ibm-api-connect':26B 'inform':60B,85C 'infrastructur':30B 'level':50B,95C 'log':54B 'logged-in':53B 'manag':25B 'multi':32B 'multi-ten':31B 'object':49B,94C 'object-level':48B,93C 'obtain':83C 'onprem':22A 'permiss':51B 'read':58B 'remot':79C 'sensit':9A,59B,84C 'tenant':8A,33B,65B,89C 'user':56B 'v12':21A 'version':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect 10.0.8.0-10.0.8.12 or V12 OnPrem 12.1.0.0-12.1.1.2. Any logged-in user can read sensitive information that belongs to other tenants because object-level permissions are not checked, so shared multi-tenant instances are the main concern. IBM's bulletins do not name the API endpoints. Single-tenant installs have less exposure, and anyone already on 10.0.8.13 or 12.1.1.3 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:25:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2070},"products":{"at":"2026-11-07T06:25:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2070},"mitigations":{"at":"2026-11-07T06:25:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2070},"workarounds":{"at":"2026-11-07T06:25:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2070},"how_to_check":{"at":"2026-11-07T06:25:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2070}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apimanagement","high","ibmapiconnect","infrastructure","multitenant"],"campaign_type":null,"search_a":"'-17112':13A,16A '-2026':12A,15A 'api':2A,17A,19A 'author':5A 'broken':4A 'connect':3A,18A,20A 'cve':11A,14A 'data':10A 'expos':6A 'ibm':1A 'onprem':22A 'sensit':9A 'tenant':8A 'v12':21A","search_b":"'10.0.8.0':38B '10.0.8.12':40B '12.1.0.0':42B '12.1.1.2':44B 'api':24B,28B,35B 'api-manag':23B 'belong':62B 'check':47B 'connect':29B,36B 'fail':45B 'ibm':27B,34B 'ibm-api-connect':26B 'inform':60B 'infrastructur':30B 'level':50B 'log':54B 'logged-in':53B 'manag':25B 'multi':32B 'multi-ten':31B 'object':49B 'object-level':48B 'permiss':51B 'read':58B 'sensit':59B 'tenant':33B,65B 'user':56B 'version':37B","search_c":"'10.0.8.0':69C '10.0.8.12':71C '12.1.0.0':73C '12.1.1.2':75C 'allow':77C 'api':67C 'attack':81C 'authent':80C 'author':96C 'belong':86C 'broken':92C 'connect':68C 'could':76C 'due':90C 'ibm':66C 'inform':85C 'level':95C 'object':94C 'object-level':93C 'obtain':83C 'remot':79C 'sensit':84C 'tenant':89C","first_public_at":"2026-11-07T05:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17112","severity":null,"published_at":"2026-11-07T05:18:25+00:00","modified_at":"2026-11-07T05:18:25+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17112:2070","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:25:23+00:00","modified_at":"2026-11-07T06:25:23+00:00","first_seen_at":"2026-11-07T06:25:23+00:00","fetched_at":"2026-11-07T06:25:23+00:00","note":"Read both IBM bulletins (node/7295637 for 10.0.8, node/7295635 for v12): CVE listed, fix 10.0.8.13 / 12.1.1.3, workarounds None. No exploitation or PoC found; endpoints not disclosed.","cites":["https://www.ibm.com/support/pages/node/7295635","https://www.ibm.com/support/pages/node/7295637"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}