{"id":"CVE-2026-17338","kind":"vulnerability","aliases":["CVE-2026-17338"],"related":[],"title":"IBM API Connect V12 OnPrem: logged-in user can read other users' sensitive data via broken authorization (fixed in 12.1.1.3)","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2 does not enforce object-level authorization, so a remote authenticated attacker can obtain sensitive information. IBM rates it CVSS 9.1 and fixes it in v12.1.1.3.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unknown","v12.1.1.3-or-later"],"how_to_check":"Check your API Connect V12 OnPrem version; v12.1.0.0 through v12.1.1.2 are affected, v12.1.1.3 contains the fix. IBM lists only V12 OnPrem for this bulletin; if you run another API Connect offering, check IBM's bulletins or ask IBM support.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:45+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:48:40+00:00","updated_at":"2026-11-07T05:55:03+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:48:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: broken authorization lets logged-in users read sensitive data","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 fail to check object-level permissions, so a remote attacker with a valid account can read data belonging to others. The NVD rates it critical (CVSS 9.1).","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive data of other users","analyst_note":"Confirm the affected components, the fixed version and the vendor advisory for IBM API Connect 12.1.x; the NVD entry gives no fix or check details.","how_to_check":"- Check whether the installed IBM API Connect version falls within `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 where users hold authenticated accounts. The sources do not say which API Connect components or configurations are exposed, so the exact data path is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000675,"input_tokens":4195,"output_tokens":511,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected components, the fixed version and the vendor advisory for IBM API Connect 12.1.x; the NVD entry gives no fix or check details.","search":"'-17338':24A,27A '-2026':23A,26A '12.1.0.0':81C '12.1.1.2':83C '12.1.1.3':21A '9.1':72B 'allow':85C 'api':2A,28A,33B,38B,45B,79C 'api-gateway':32B 'attack':63B,89C 'authent':35B,62B,88C 'author':18A,58B,100C 'broken':17A,96C 'connect':3A,29A,39B,46B,80C 'could':84C 'cve':22A,25A 'cvss':71B 'data':15A 'due':94C 'enforc':54B 'fix':19A,74B 'gateway':34B 'host':42B 'ibm':1A,37B,44B,68B,78C 'ibm-api-connect':36B 'inform':67B,93C 'level':57B,99C 'log':7A 'logged-in':6A 'object':56B,98C 'object-level':55B,97C 'obtain':65B,91C 'onprem':5A,31A,48B 'rate':69B 'read':11A 'remot':61B,87C 'self':41B 'self-host':40B 'sensit':14A,66B,92C 'user':9A,13A 'v12':4A,30A,47B 'v12.1.0.0':49B 'v12.1.1.2':51B 'v12.1.1.3':77B 'vendor':43B 'via':16A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 OnPrem, versions v12.1.0.0 to v12.1.1.2, where any logged-in user with low privileges can reach the API. Broken object-level authorization lets that user read sensitive data they should not see. IBM lists no workaround; teams on v12.1.1.3 or later, or on offerings not named in the bulletin, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:55:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1976},"products":{"at":"2026-11-07T05:55:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1976},"workarounds":{"at":"2026-11-07T05:55:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1976},"how_to_check":{"at":"2026-11-07T05:55:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1976},"who_affected":{"at":"2026-11-07T05:55:03Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1976}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17338':24A,27A '-2026':23A,26A '12.1.1.3':21A 'api':2A,28A 'author':18A 'broken':17A 'connect':3A,29A 'cve':22A,25A 'data':15A 'fix':19A 'ibm':1A 'log':7A 'logged-in':6A 'onprem':5A,31A 'read':11A 'sensit':14A 'user':9A,13A 'v12':4A,30A 'via':16A","search_b":"'9.1':72B 'api':33B,38B,45B 'api-gateway':32B 'attack':63B 'authent':35B,62B 'author':58B 'connect':39B,46B 'cvss':71B 'enforc':54B 'fix':74B 'gateway':34B 'host':42B 'ibm':37B,44B,68B 'ibm-api-connect':36B 'inform':67B 'level':57B 'object':56B 'object-level':55B 'obtain':65B 'onprem':48B 'rate':69B 'remot':61B 'self':41B 'self-host':40B 'sensit':66B 'v12':47B 'v12.1.0.0':49B 'v12.1.1.2':51B 'v12.1.1.3':77B 'vendor':43B","search_c":"'12.1.0.0':81C '12.1.1.2':83C 'allow':85C 'api':79C 'attack':89C 'authent':88C 'author':100C 'broken':96C 'connect':80C 'could':84C 'due':94C 'ibm':78C 'inform':93C 'level':99C 'object':98C 'object-level':97C 'obtain':91C 'remot':87C 'sensit':92C","first_public_at":"2026-11-07T05:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17338","severity":null,"published_at":"2026-11-07T05:18:45+00:00","modified_at":"2026-11-07T05:18:45+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17338:1976","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:55:03+00:00","modified_at":"2026-11-07T05:55:03+00:00","first_seen_at":"2026-11-07T05:55:03+00:00","fetched_at":"2026-11-07T05:55:03+00:00","note":"IBM bulletin -39 (2026-11-05) lists CVE-2026-17338 (CWE-639, CVSS 9.1, remote authenticated); affects API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds none. No exploitation or PoC seen in sources (Feedly says none).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}