{"id":"CVE-2026-17283","kind":"vulnerability","aliases":["CVE-2026-17283"],"related":[],"title":"IBM API Connect: broken object-level authorization leaks sensitive data to users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can obtain sensitive information belonging to other objects.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the installed API Connect version against the affected ranges, 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.","fix":"- Move to a version after the affected ranges; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-07T05:18:34+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:50:48+00:00","updated_at":"2026-11-07T05:50:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:50:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version after the affected ranges; the exact fixed version is unknown from the sources.","reach":"network","title":"IBM API Connect: broken object-level authorization leaks sensitive data to users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can obtain sensitive information belonging to other objects.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive data of other objects","analyst_note":"Confirm the fixed versions and any vendor advisory for CVE-2026-17283 from IBM's security bulletins; the sources give only NVD.","how_to_check":"- Check the installed API Connect version against the affected ranges, 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where users with valid accounts can reach API objects they should not see. Deployments on versions outside 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":4226,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17283':16A,19A '-2026':15A,18A '10.0.8.0':35B,67C '10.0.8.12':37B,69C '12.1.0.0':39B,71C '12.1.1.2':41B,73C 'account':55B 'allow':75C 'api':2A,21B,25B,32B,65C 'api-gateway':20B 'attack':51B,79C 'authent':78C 'author':8A,48B,90C 'belong':60B 'broken':4A,86C 'check':44B 'connect':3A,26B,33B,66C 'could':74C 'cve':14A,17A 'data':11A 'due':84C 'fail':42B 'gateway':22B 'host':29B 'ibm':1A,24B,31B,64C 'ibm-api-connect':23B 'inform':59B,83C 'leak':9A 'level':7A,47B,89C 'object':6A,46B,63B,88C 'object-level':5A,45B,87C 'obtain':57B,81C 'remot':50B,77C 'self':28B 'self-host':27B 'sensit':10A,58B,82C 'user':13A 'valid':54B 'vendor':30B 'version':34B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where users with valid accounts can reach API objects they should not see. Deployments on versions outside 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 are not listed as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17283':16A,19A '-2026':15A,18A 'api':2A 'author':8A 'broken':4A 'connect':3A 'cve':14A,17A 'data':11A 'ibm':1A 'leak':9A 'level':7A 'object':6A 'object-level':5A 'sensit':10A 'user':13A","search_b":"'10.0.8.0':35B '10.0.8.12':37B '12.1.0.0':39B '12.1.1.2':41B 'account':55B 'api':21B,25B,32B 'api-gateway':20B 'attack':51B 'author':48B 'belong':60B 'check':44B 'connect':26B,33B 'fail':42B 'gateway':22B 'host':29B 'ibm':24B,31B 'ibm-api-connect':23B 'inform':59B 'level':47B 'object':46B,63B 'object-level':45B 'obtain':57B 'remot':50B 'self':28B 'self-host':27B 'sensit':58B 'valid':54B 'vendor':30B 'version':34B","search_c":"'10.0.8.0':67C '10.0.8.12':69C '12.1.0.0':71C '12.1.1.2':73C 'allow':75C 'api':65C 'attack':79C 'authent':78C 'author':90C 'broken':86C 'connect':66C 'could':74C 'due':84C 'ibm':64C 'inform':83C 'level':89C 'object':88C 'object-level':87C 'obtain':81C 'remot':77C 'sensit':82C","first_public_at":"2026-11-07T05:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17283","severity":null,"published_at":"2026-11-07T05:18:34+00:00","modified_at":"2026-11-07T05:18:34+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}