{"id":"CVE-2026-17293","kind":"vulnerability","aliases":["CVE-2026-17293"],"related":[],"title":"IBM API Connect: authenticated users can modify other users' profiles","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check whether a logged-in user may change a given profile. A remote attacker with a valid account can alter user profile information belonging to others.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"Check the installed API Connect version: affected if V10 is 10.0.8.0 through 10.0.8.12, or V12 is 12.1.0.0 through 12.1.1.2. Fixed at 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (V10) or v12.1.1.3 (V12, Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:50:11+00:00","updated_at":"2026-11-07T06:20:57+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:50:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can modify other users' profiles","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check whether a logged-in user may change a given profile. A remote attacker with a valid account can alter user profile information belonging to others.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker alters other users' profile information on the platform","analyst_note":"Check IBM's security bulletin for CVE-2026-17293 for the fixed version and any workaround; the NVD entry alone does not state a fix.","how_to_check":"- Check the installed API Connect version against `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where authenticated users can reach the user profile management functions. The sources do not say which deployment or configuration choices limit exposure. Teams on other versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4249,"output_tokens":534,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-17293 for the fixed version and any workaround; the NVD entry alone does not state a fix.","search":"'-17293':13A,16A '-2026':12A,15A '10.0.8.0':37B,76C '10.0.8.12':39B,78C '12.1.0.0':41B,80C '12.1.1.2':43B,82C 'access':101C 'account':64B 'allow':84C 'alter':66B 'api':2A,17A,19A,23B,27B,34B,74C 'api-gateway':22B 'attack':60B,88C 'authent':4A,87C 'author':100C 'belong':70B 'broken':96C 'chang':54B,112C 'check':46B,102C 'confirm':105C 'connect':3A,18A,20A,28B,35B,75C 'could':83C 'cve':11A,14A 'due':94C 'fail':44B 'gateway':24B 'given':56B 'host':31B 'ibm':1A,26B,33B,73C 'ibm-api-connect':25B 'inform':69B,93C 'level':99C 'log':50B 'logged-in':49B 'may':53B 'modifi':7A,90C 'object':98C 'object-level':97C 'other':72B 'permit':110C 'profil':10A,57B,68B,92C,115C 'remot':59B,86C 'self':30B 'self-host':29B 'target':114C 'user':5A,9A,52B,67B,91C,108C 'v12':21A 'valid':63B 'vendor':32B 'version':36B 'whether':47B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect (V10.0.8.x up to 10.0.8.12, or V12 on-prem 12.1.0.0 to 12.1.1.2). Any logged-in user can change other users' profile information because the profile access check is missing. Skip it if you are already on 10.0.8.13 or 12.1.1.3, or do not run API Connect.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:20:57Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2055},"products":{"at":"2026-11-07T06:20:57Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2055},"workarounds":{"at":"2026-11-07T06:20:57Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2055},"how_to_check":{"at":"2026-11-07T06:20:57Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2055},"who_affected":{"at":"2026-11-07T06:20:57Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2055}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12","connect","connectv12"],"ptokens":["api","connect","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17293':13A,16A '-2026':12A,15A 'api':2A,17A,19A 'authent':4A 'connect':3A,18A,20A 'cve':11A,14A 'ibm':1A 'modifi':7A 'profil':10A 'user':5A,9A 'v12':21A","search_b":"'10.0.8.0':37B '10.0.8.12':39B '12.1.0.0':41B '12.1.1.2':43B 'account':64B 'alter':66B 'api':23B,27B,34B 'api-gateway':22B 'attack':60B 'belong':70B 'chang':54B 'check':46B 'connect':28B,35B 'fail':44B 'gateway':24B 'given':56B 'host':31B 'ibm':26B,33B 'ibm-api-connect':25B 'inform':69B 'log':50B 'logged-in':49B 'may':53B 'other':72B 'profil':57B,68B 'remot':59B 'self':30B 'self-host':29B 'user':52B,67B 'valid':63B 'vendor':32B 'version':36B 'whether':47B","search_c":"'10.0.8.0':76C '10.0.8.12':78C '12.1.0.0':80C '12.1.1.2':82C 'access':101C 'allow':84C 'api':74C 'attack':88C 'authent':87C 'author':100C 'broken':96C 'chang':112C 'check':102C 'confirm':105C 'connect':75C 'could':83C 'due':94C 'ibm':73C 'inform':93C 'level':99C 'modifi':90C 'object':98C 'object-level':97C 'permit':110C 'profil':92C,115C 'remot':86C 'target':114C 'user':91C,108C","first_public_at":"2026-11-07T05:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17293","severity":null,"published_at":"2026-11-07T05:18:36+00:00","modified_at":"2026-11-07T05:18:36+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17293:2055","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:20:57+00:00","modified_at":"2026-11-07T06:20:57+00:00","first_seen_at":"2026-11-07T06:20:57+00:00","fetched_at":"2026-11-07T06:20:57+00:00","note":"Read both IBM bulletins (10.0.8.13 and v12.1.1.3 pages); fix and 'no workarounds' stated by IBM. Not exploited, no PoC checked/found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}