{"id":"CVE-2026-17236","kind":"vulnerability","aliases":["CVE-2026-17236"],"related":[],"title":"IBM API Connect: authorization gap exposes other organizations' information to authenticated users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved, which could allow access to information belonging to others.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 skip authorization checks when certain organization URLs are resolved. A logged-in attacker can read information belonging to other organizations.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-connect","api-management","ibm","infrastructure"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed API Connect version in the management console or product documentation against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":"- Move to a release newer than the affected ranges; the sources do not name the fixed version","status":"open","published_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:52:44+00:00","updated_at":"2026-11-07T05:52:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:52:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than the affected ranges; the sources do not name the fixed version","reach":"network","title":"IBM API Connect: authorization gap exposes other organizations' information to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 skip authorization checks when certain organization URLs are resolved. A logged-in attacker can read information belonging to other organizations.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm","api-connect","api-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads another organization's sensitive information","analyst_note":"Confirm the fixed version and whether the flaw depends on configuration, using the IBM security bulletin for CVE-2026-17236.","how_to_check":"- Check the installed API Connect version in the management console or product documentation against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Only deployments of IBM API Connect in the listed version ranges are affected. The attacker needs a valid account on the platform, and the sources do not say whether the issue depends on any non-default setting. unknown whether multi-tenant or single-organization installs differ.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4260,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17236':15A,18A '-2026':14A,17A '10.0.8.0':31B,62C '10.0.8.12':33B,64C '12.1.0.0':35B,66C '12.1.1.2':37B,68C 'access':97C 'allow':70C,96C 'api':2A,20B,23B,28B,60C 'api-connect':19B 'api-manag':22B 'appli':87C 'attack':51B,74C 'authent':11A,73C 'author':4A,39B,82C,83C 'belong':55B,100C 'certain':42B,89C 'check':40B,84C 'connect':3A,21B,29B,61C 'could':69C,95C 'cve':13A,16A 'due':79C 'expos':6A 'gap':5A 'ibm':1A,25B,27B,59C 'improp':81C 'inform':9A,54B,78C,99C 'infrastructur':26B 'log':49B 'logged-in':48B 'manag':24B 'obtain':76C 'organ':8A,43B,58B,90C 'other':102C 'read':53B 'remot':72C 'resolv':46B,93C 'sensit':77C 'skip':38B 'url':44B,91C 'user':12A 'version':30B","nicknames":[],"mitigations":[],"who_affected":"Only deployments of IBM API Connect in the listed version ranges are affected. The attacker needs a valid account on the platform, and the sources do not say whether the issue depends on any non-default setting. unknown whether multi-tenant or single-organization installs differ.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apiconnect","apimanagement","ibm","infrastructure","medium"],"campaign_type":null,"search_a":"'-17236':15A,18A '-2026':14A,17A 'api':2A 'authent':11A 'author':4A 'connect':3A 'cve':13A,16A 'expos':6A 'gap':5A 'ibm':1A 'inform':9A 'organ':8A 'user':12A","search_b":"'10.0.8.0':31B '10.0.8.12':33B '12.1.0.0':35B '12.1.1.2':37B 'api':20B,23B,28B 'api-connect':19B 'api-manag':22B 'attack':51B 'author':39B 'belong':55B 'certain':42B 'check':40B 'connect':21B,29B 'ibm':25B,27B 'inform':54B 'infrastructur':26B 'log':49B 'logged-in':48B 'manag':24B 'organ':43B,58B 'read':53B 'resolv':46B 'skip':38B 'url':44B 'version':30B","search_c":"'10.0.8.0':62C '10.0.8.12':64C '12.1.0.0':66C '12.1.1.2':68C 'access':97C 'allow':70C,96C 'api':60C 'appli':87C 'attack':74C 'authent':73C 'author':82C,83C 'belong':100C 'certain':89C 'check':84C 'connect':61C 'could':69C,95C 'due':79C 'ibm':59C 'improp':81C 'inform':78C,99C 'obtain':76C 'organ':90C 'other':102C 'remot':72C 'resolv':93C 'sensit':77C 'url':91C","first_public_at":"2026-11-07T05:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17236","severity":null,"published_at":"2026-11-07T05:18:32+00:00","modified_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}