{"id":"CVE-2026-17225","kind":"vulnerability","aliases":["CVE-2026-17225"],"related":[],"title":"IBM API Connect: authenticated user can bypass analytics query restrictions","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate request parameters enough. A logged-in attacker can use this to get analytics data they should not be allowed to see.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed API Connect version in the product's admin console or release notes against the affected ranges","fix":null,"status":"open","published_at":"2026-11-07T05:18:30+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:54:05+00:00","updated_at":"2026-11-07T05:54:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:54:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown, the sources do not state a fixed version","reach":"network","title":"IBM API Connect: authenticated user can bypass analytics query restrictions","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate request parameters enough. A logged-in attacker can use this to get analytics data they should not be allowed to see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads analytics data outside their permitted scope","analyst_note":"","how_to_check":"- Check the installed API Connect version in the product's admin console or release notes against the affected ranges\n- unknown for any other check, the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["other-versions"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges, where authenticated users can reach the analytics query interface. The sources do not say which deployment settings make this reachable, so unknown. Teams on other versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":4271,"output_tokens":478,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17225':13A,16A '-2026':12A,15A '10.0.8.0':32B,67C '10.0.8.12':34B,69C '12.1.0.0':36B,71C '12.1.1.2':38B,73C 'access':85C 'allow':61B,75C,102C 'analyt':8A,55B,87C,105C 'api':2A,18B,22B,29B,65C 'api-gateway':17B 'attack':49B,79C 'authent':4A,78C 'bypass':7A,81C 'circumv':109C 'connect':3A,23B,30B,66C 'could':74C,101C 'cve':11A,14A 'data':56B,106C 'due':89C 'enough':44B 'gateway':19B 'get':54B 'host':27B 'ibm':1A,21B,28B,64C 'ibm-api-connect':20B 'improp':91C 'infrastructur':24B 'input':92C 'log':47B 'logged-in':46B 'paramet':43B,95C 'queri':9A,88C 'remot':77C 'request':42B,94C 'restrict':10A,83C,103C 'secur':82C 'see':63B 'self':26B 'self-host':25B 'suffici':99C 'unauthor':86C 'use':51B 'user':5A 'valid':41B,93C,98C 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect in the affected version ranges, where authenticated users can reach the analytics query interface. The sources do not say which deployment settings make this reachable, so unknown. Teams on other versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17225':13A,16A '-2026':12A,15A 'analyt':8A 'api':2A 'authent':4A 'bypass':7A 'connect':3A 'cve':11A,14A 'ibm':1A 'queri':9A 'restrict':10A 'user':5A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'allow':61B 'analyt':55B 'api':18B,22B,29B 'api-gateway':17B 'attack':49B 'connect':23B,30B 'data':56B 'enough':44B 'gateway':19B 'get':54B 'host':27B 'ibm':21B,28B 'ibm-api-connect':20B 'infrastructur':24B 'log':47B 'logged-in':46B 'paramet':43B 'request':42B 'see':63B 'self':26B 'self-host':25B 'use':51B 'valid':41B 'version':31B","search_c":"'10.0.8.0':67C '10.0.8.12':69C '12.1.0.0':71C '12.1.1.2':73C 'access':85C 'allow':75C,102C 'analyt':87C,105C 'api':65C 'attack':79C 'authent':78C 'bypass':81C 'circumv':109C 'connect':66C 'could':74C,101C 'data':106C 'due':89C 'ibm':64C 'improp':91C 'input':92C 'paramet':95C 'queri':88C 'remot':77C 'request':94C 'restrict':83C,103C 'secur':82C 'suffici':99C 'unauthor':86C 'valid':93C,98C","first_public_at":"2026-11-07T05:18:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17225","severity":null,"published_at":"2026-11-07T05:18:30+00:00","modified_at":"2026-11-07T05:18:31+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}