{"id":"CVE-2026-17311","kind":"vulnerability","aliases":["CVE-2026-17311"],"related":[],"title":"IBM API Connect: authenticated users can modify others' API subscriptions","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have a broken object-level authorization flaw. A logged-in remote user can change application API subscriptions that belong to other applications.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["auth-required","other-versions","unauthenticated-only-access"],"how_to_check":"Check installed API Connect V12 on-prem version; v12.1.0.0 through v12.1.1.2 are affected, v12.1.1.3 is fixed. The attacker needs a login, so also review who holds accounts. IBM lists no workaround.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:52:19+00:00","updated_at":"2026-11-07T06:19:47+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:52:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can modify others' API subscriptions","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 have a broken object-level authorization flaw. A logged-in remote user can change application API subscriptions that belong to other applications.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user alters other applications' API subscriptions","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and any required configuration; NVD text alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","other-versions"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users hold valid accounts on the gateway or management platform. The flaw lets an authenticated user modify subscriptions tied to other applications. Teams on other versions or without API Connect can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":4192,"output_tokens":516,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and any required configuration; NVD text alone gives no fix.","search":"'-17311':13A,16A '-2026':12A,15A '12.1.0.0':39B,69C '12.1.1.2':41B,71C 'allow':73C 'api':2A,9A,17A,22B,29B,36B,59B,67C,81C 'api-gateway':21B 'applic':58B,65B,80C 'attack':77C 'auth':25B 'auth-requir':24B 'authent':4A,76C 'author':48B,89C 'belong':62B 'broken':44B,85C 'chang':57B 'connect':3A,18A,30B,37B,68C 'could':72C 'cve':11A,14A 'due':83C 'flaw':49B 'gateway':23B 'host':34B 'ibm':1A,28B,35B,66C 'ibm-api-connect':27B 'infrastructur':31B 'level':47B,88C 'log':52B 'logged-in':51B 'modifi':7A,79C 'object':46B,87C 'object-level':45B,86C 'onprem':20A 'other':8A 'remot':54B,75C 'requir':26B 'self':33B 'self-host':32B 'subscript':10A,60B,82C 'user':5A,55B 'v12':19A 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect V12 on-premises, versions 12.1.0.0 to 12.1.1.2. Any logged-in user could change API subscriptions that belong to other applications. Skip it if you are on 12.1.1.3 or later; IBM's bulletin lists only the V12 OnPrem product for this range.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:19:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2051},"products":{"at":"2026-11-07T06:19:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2051},"workarounds":{"at":"2026-11-07T06:19:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2051},"how_to_check":{"at":"2026-11-07T06:19:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2051},"who_affected":{"at":"2026-11-07T06:19:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2051}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17311':13A,16A '-2026':12A,15A 'api':2A,9A,17A 'authent':4A 'connect':3A,18A 'cve':11A,14A 'ibm':1A 'modifi':7A 'onprem':20A 'other':8A 'subscript':10A 'user':5A 'v12':19A","search_b":"'12.1.0.0':39B '12.1.1.2':41B 'api':22B,29B,36B,59B 'api-gateway':21B 'applic':58B,65B 'auth':25B 'auth-requir':24B 'author':48B 'belong':62B 'broken':44B 'chang':57B 'connect':30B,37B 'flaw':49B 'gateway':23B 'host':34B 'ibm':28B,35B 'ibm-api-connect':27B 'infrastructur':31B 'level':47B 'log':52B 'logged-in':51B 'object':46B 'object-level':45B 'remot':54B 'requir':26B 'self':33B 'self-host':32B 'subscript':60B 'user':55B 'version':38B","search_c":"'12.1.0.0':69C '12.1.1.2':71C 'allow':73C 'api':67C,81C 'applic':80C 'attack':77C 'authent':76C 'author':89C 'broken':85C 'connect':68C 'could':72C 'due':83C 'ibm':66C 'level':88C 'modifi':79C 'object':87C 'object-level':86C 'remot':75C 'subscript':82C","first_public_at":"2026-11-07T05:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17311","severity":null,"published_at":"2026-11-07T05:18:39+00:00","modified_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17311:2051","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:19:47+00:00","modified_at":"2026-11-07T06:19:47+00:00","first_seen_at":"2026-11-07T06:19:47+00:00","fetched_at":"2026-11-07T06:19:47+00:00","note":"Read IBM bulletin (api-connect-39): CVE-2026-17311 CWE-639, CVSS 7.1; affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2; fixed v12.1.1.3; IBM lists no workarounds. No exploitation or PoC seen; X/social not searched.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}