{"id":"CVE-2026-17318","kind":"vulnerability","aliases":["CVE-2026-17318"],"related":[],"title":"IBM API Connect 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2: authenticated user can read other users' sensitive information; fixed in 10.0.8.13 and 12.1.1.3","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.","summary":"IBM says API Connect could let a remote authenticated attacker obtain sensitive information due to improper authorization (CWE-639, user-controlled key; CVSS 7.7, AV:N/AC:L/PR:L). Affected: V10.0.8.0-10.0.8.12 and V12 OnPrem v12.1.0.0-v12.1.1.2. Fixed in 10.0.8.13 and v12.1.1.3. IBM lists no workarounds. No exploitation or PoC stated. IBM does not name the endpoint or data exposed.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["auth-required","outside-affected-range","version-outside-range"],"how_to_check":"Check your API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and V12 OnPrem 12.1.0.0 through 12.1.1.2. Fixed: 10.0.8.13 and 12.1.1.3. IBM's bulletin does not name the vulnerable endpoint.","fix":"Upgrade to 10.0.8.13 (V10 line) or v12.1.1.3 (V12 OnPrem; Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:41+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:50:44+00:00","updated_at":"2026-11-07T06:20:03+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can obtain sensitive information","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not check authorization properly. A signed-in remote user can read sensitive information they should not be able to see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information they should not access","analyst_note":"Check the IBM security bulletin for the fixed versions and the affected endpoints; the NVD entry gives only the description.","how_to_check":"- Check the installed API Connect version against the affected ranges (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2).\n- unknown for further checks; the sources do not say which endpoints or settings are involved.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges. The sources do not say which endpoints expose the data, so exposure beyond the version ranges is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4223,"output_tokens":512,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for the fixed versions and the affected endpoints; the NVD entry gives only the description.","search":"'-17318':24A,27A '-2026':23A,26A '-639':64B '10.0.8.0':4A,107C '10.0.8.12':5A,109C '10.0.8.13':19A,83B '12.1.0.0':7A,111C '12.1.1.2':8A,113C '12.1.1.3':21A '7.7':70B 'affect':75B 'allow':115C 'api':2A,28A,30A,35B,40B,48B,105C 'api-gateway':34B 'attack':55B,119C 'authent':9A,37B,54B,118C 'author':62B,127C 'av':71B 'connect':3A,29A,31A,41B,49B,106C 'control':67B 'could':50B,114C 'cve':22A,25A 'cvss':69B 'cwe':63B 'data':102B 'due':59B,124C 'endpoint':100B 'exploit':91B 'expos':103B 'fix':17A,81B 'gateway':36B 'host':45B 'ibm':1A,39B,46B,86B,95B,104C 'ibm-api-connect':38B 'improp':61B,126C 'inform':16A,58B,123C 'infrastructur':42B 'key':68B 'l':74B 'l/pr':73B 'let':51B 'list':87B 'n/ac':72B 'name':98B 'obtain':56B,121C 'onprem':33A,79B 'poc':93B 'read':12A 'remot':53B,117C 'say':47B 'self':44B 'self-host':43B 'sensit':15A,57B,122C 'state':94B 'user':10A,14A,66B 'user-control':65B 'v10.0.8.0-10.0.8.12':76B 'v12':32A,78B 'v12.1.0.0-v12.1.1.2':80B 'v12.1.1.3':85B 'workaround':89B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect on 10.0.8.0-10.0.8.12 or V12 OnPrem 12.1.0.0-12.1.1.2 is exposed to any logged-in user, who could read information they should not see through a flaw in authorization checks. Look at deployments where untrusted or multi-tenant users hold API Connect accounts. Deployments already on 10.0.8.13 or 12.1.1.3 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:20:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2049},"products":{"at":"2026-11-07T06:20:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2049},"workarounds":{"at":"2026-11-07T06:20:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2049},"how_to_check":{"at":"2026-11-07T06:20:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2049},"who_affected":{"at":"2026-11-07T06:20:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2049}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17318':24A,27A '-2026':23A,26A '10.0.8.0':4A '10.0.8.12':5A '10.0.8.13':19A '12.1.0.0':7A '12.1.1.2':8A '12.1.1.3':21A 'api':2A,28A,30A 'authent':9A 'connect':3A,29A,31A 'cve':22A,25A 'fix':17A 'ibm':1A 'inform':16A 'onprem':33A 'read':12A 'sensit':15A 'user':10A,14A 'v12':32A","search_b":"'-639':64B '10.0.8.13':83B '7.7':70B 'affect':75B 'api':35B,40B,48B 'api-gateway':34B 'attack':55B 'authent':37B,54B 'author':62B 'av':71B 'connect':41B,49B 'control':67B 'could':50B 'cvss':69B 'cwe':63B 'data':102B 'due':59B 'endpoint':100B 'exploit':91B 'expos':103B 'fix':81B 'gateway':36B 'host':45B 'ibm':39B,46B,86B,95B 'ibm-api-connect':38B 'improp':61B 'inform':58B 'infrastructur':42B 'key':68B 'l':74B 'l/pr':73B 'let':51B 'list':87B 'n/ac':72B 'name':98B 'obtain':56B 'onprem':79B 'poc':93B 'remot':53B 'say':47B 'self':44B 'self-host':43B 'sensit':57B 'state':94B 'user':66B 'user-control':65B 'v10.0.8.0-10.0.8.12':76B 'v12':78B 'v12.1.0.0-v12.1.1.2':80B 'v12.1.1.3':85B 'workaround':89B","search_c":"'10.0.8.0':107C '10.0.8.12':109C '12.1.0.0':111C '12.1.1.2':113C 'allow':115C 'api':105C 'attack':119C 'authent':118C 'author':127C 'connect':106C 'could':114C 'due':124C 'ibm':104C 'improp':126C 'inform':123C 'obtain':121C 'remot':117C 'sensit':122C","first_public_at":"2026-11-07T05:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17318","severity":null,"published_at":"2026-11-07T05:18:41+00:00","modified_at":"2026-11-07T05:18:41+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17318:2049","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:20:03+00:00","modified_at":"2026-11-07T06:20:03+00:00","first_seen_at":"2026-11-07T06:20:03+00:00","fetched_at":"2026-11-07T06:20:03+00:00","note":"Read IBM bulletins -39 (V12, fixed 12.1.1.3) and -41 (V10, fixed 10.0.8.13), both 2026-11-05, both list CVE-2026-17318 (CWE-639, CVSS 7.7). No workarounds, no exploitation stated. Page text for -39 was truncated in web-cli; affected table read via WebFetch.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}