---
id: "CVE-2026-17225"
page: "https://infrastack.ai/live/CVE-2026-17225"
kind: "vulnerability"
aliases: ["CVE-2026-17225"]
title: "IBM API Connect: authenticated user can bypass analytics query restrictions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "infrastructure", "self-hosted"]
not_affected_if: ["other-versions"]
published_at: "2026-11-07T05:18:30+00:00"
first_seen_at: "2026-11-07T05:46:00+00:00"
updated_at: "2026-11-07T05:54:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17225", "first_seen_at": "2026-11-07T05:46:00+00:00"}]
exploit_sources: []
---

# IBM API Connect: authenticated user can bypass analytics query restrictions

Link for people: https://infrastack.ai/live/CVE-2026-17225 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate request parameters enough. A logged-in attacker can use this to get analytics data they should not be allowed to see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed API Connect version in the product's admin console or release notes against the affected ranges

## Timeline

- 2026-11-07T05:46:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17225

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_