{"id":"CVE-2026-17320","kind":"vulnerability","aliases":["CVE-2026-17320"],"related":[],"title":"IBM API Connect: authenticated users can read sensitive data via object references","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference flaw. A logged-in attacker can request objects belonging to others and obtain sensitive information.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["auth-required","outside-affected-range","outside-affected-versions"],"how_to_check":"Check your API Connect V12 OnPrem version. v12.1.0.0 through v12.1.1.2 is affected; v12.1.1.3 is fixed. IBM does not name the vulnerable endpoint or object type.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:41+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:50:43+00:00","updated_at":"2026-11-07T06:18:39+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can read sensitive data via object references","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference flaw. A logged-in attacker can request objects belonging to others and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive information belonging to other objects","analyst_note":"Find IBM's security bulletin for CVE-2026-17320 to confirm the fixed version and affected components; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- Review IBM's security bulletin for CVE-2026-17320 for the exact affected components (unknown from the sources given)","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users hold accounts on the platform. The sources do not state which deployment modes or roles are involved, so the exposure beyond the version range is unknown. Installations outside that version range are not affected per the NVD description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4195,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17320 to confirm the fixed version and affected components; the NVD entry alone gives no fix.","search":"'-17320':15A,18A '-2026':14A,17A '12.1.0.0':38B,66C '12.1.1.2':40B,68C 'allow':70C 'api':2A,19A,24B,28B,35B,64C 'api-gateway':23B 'attack':52B,74C 'authent':4A,73C 'belong':56B 'connect':3A,20A,29B,36B,65C 'contain':41B 'could':69C 'cve':13A,16A 'data':9A 'direct':44B,83C 'due':79C 'flaw':47B 'gateway':25B 'host':32B 'ibm':1A,27B,34B,63C 'ibm-api-connect':26B 'inform':62B,78C 'insecur':43B,82C 'log':50B 'logged-in':49B 'object':11A,45B,55B,84C 'obtain':60B,76C 'onprem':22A 'other':58B 'read':7A 'refer':12A,46B,85C 'remot':72C 'request':54B 'self':31B 'self-host':30B 'sensit':8A,61B,77C 'user':5A 'v12':21A 'vendor':33B 'version':37B 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect V12 OnPrem deployments on 12.1.0.0 to 12.1.1.2 are exposed to a logged-in remote user who can request objects belonging to others and read sensitive information (insecure direct object reference). Teams on other versions or not running API Connect V12 OnPrem can skip it. IBM does not name the specific endpoint.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:18:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2047},"products":{"at":"2026-11-07T06:18:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2047},"workarounds":{"at":"2026-11-07T06:18:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2047},"how_to_check":{"at":"2026-11-07T06:18:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2047},"who_affected":{"at":"2026-11-07T06:18:39Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2047}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17320':15A,18A '-2026':14A,17A 'api':2A,19A 'authent':4A 'connect':3A,20A 'cve':13A,16A 'data':9A 'ibm':1A 'object':11A 'onprem':22A 'read':7A 'refer':12A 'sensit':8A 'user':5A 'v12':21A 'via':10A","search_b":"'12.1.0.0':38B '12.1.1.2':40B 'api':24B,28B,35B 'api-gateway':23B 'attack':52B 'belong':56B 'connect':29B,36B 'contain':41B 'direct':44B 'flaw':47B 'gateway':25B 'host':32B 'ibm':27B,34B 'ibm-api-connect':26B 'inform':62B 'insecur':43B 'log':50B 'logged-in':49B 'object':45B,55B 'obtain':60B 'other':58B 'refer':46B 'request':54B 'self':31B 'self-host':30B 'sensit':61B 'vendor':33B 'version':37B","search_c":"'12.1.0.0':66C '12.1.1.2':68C 'allow':70C 'api':64C 'attack':74C 'authent':73C 'connect':65C 'could':69C 'direct':83C 'due':79C 'ibm':63C 'inform':78C 'insecur':82C 'object':84C 'obtain':76C 'refer':85C 'remot':72C 'sensit':77C","first_public_at":"2026-11-07T05:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17320","severity":null,"published_at":"2026-11-07T05:18:41+00:00","modified_at":"2026-11-07T05:18:41+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17320:2047","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:18:39+00:00","modified_at":"2026-11-07T06:18:39+00:00","first_seen_at":"2026-11-07T06:18:39+00:00","fetched_at":"2026-11-07T06:18:39+00:00","note":"Read IBM bulletin (node -39, 2026-11-05): CVE-2026-17320 IDOR (CWE-639), CVSS 7.7, API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fixed v12.1.1.3, workarounds None. Endpoint/object type not named; no exploitation or PoC stated.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}