{"id":"CVE-2026-17343","kind":"vulnerability","aliases":["CVE-2026-17343"],"related":[],"title":"IBM API Connect: authenticated users can bypass authorization checks on data","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 fail to enforce proper authorization checks. A remote attacker with a valid account can read or modify sensitive information they should not reach.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check your API Connect V12 on-prem version: affected if it is v12.1.0.0 through v12.1.1.2. IBM lists no workaround; the fix is v12.1.1.3. Also check if you run other API Connect lines: the bulletin lists only V12 OnPrem for this CVE.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:50:28+00:00","updated_at":"2026-11-07T06:14:05+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-07T05:50:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can bypass authorization checks on data","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 fail to enforce proper authorization checks. A remote attacker with a valid account can read or modify sensitive information they should not reach.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads or modifies sensitive data without permission","analyst_note":"Find the IBM security bulletin for CVE-2026-17343 to confirm the fixed version and any affected configuration.","how_to_check":"- Confirm the installed API Connect version against the affected range 12.1.0.0 through 12.1.1.2 in the product's version or management console\n- Review the IBM security bulletin for this CVE, which the sources do not link","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM API Connect 12.1.0.0 through 12.1.1.2 where some users have valid accounts. The sources do not describe the specific configuration or role needed to reach the flawed check. unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4202,"output_tokens":515,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17343 to confirm the fixed version and any affected configuration.","search":"'-17343':14A,17A '-2026':13A,16A '12.1.0.0':38B,67C '12.1.1.2':40B,69C 'access':81C 'account':53B 'allow':71C 'api':2A,18A,23B,28B,35B,65C 'api-gateway':22B 'attack':49B,75C 'authent':4A,25B,74C 'author':8A,45B,78C,89C 'bypass':7A,77C 'check':9A,46B,79C 'connect':3A,19A,29B,36B,66C 'could':70C 'cve':12A,15A 'data':11A 'due':86C 'enforc':43B 'fail':41B 'gateway':24B 'host':33B 'ibm':1A,27B,34B,64C 'ibm-api-connect':26B 'improp':88C 'inform':59B,85C 'infrastructur':30B 'modifi':57B,83C 'onprem':21A 'proper':44B 'reach':63B 'read':55B 'remot':48B,73C 'self':32B 'self-host':31B 'sensit':58B,84C 'user':5A 'v12':20A 'valid':52B 'version':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 (on-prem) v12.1.0.0 through v12.1.1.2. Any user with a valid account can reach the flaw over the network (CWE-863 incorrect authorization) and read or modify data they should not access. IBM lists no workaround. Skip if you are on v12.1.1.3 or later.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:14:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2032},"products":{"at":"2026-11-07T06:14:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2032},"how_to_check":{"at":"2026-11-07T06:14:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2032},"who_affected":{"at":"2026-11-07T06:14:05Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2032}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17343':14A,17A '-2026':13A,16A 'api':2A,18A 'authent':4A 'author':8A 'bypass':7A 'check':9A 'connect':3A,19A 'cve':12A,15A 'data':11A 'ibm':1A 'onprem':21A 'user':5A 'v12':20A","search_b":"'12.1.0.0':38B '12.1.1.2':40B 'account':53B 'api':23B,28B,35B 'api-gateway':22B 'attack':49B 'authent':25B 'author':45B 'check':46B 'connect':29B,36B 'enforc':43B 'fail':41B 'gateway':24B 'host':33B 'ibm':27B,34B 'ibm-api-connect':26B 'inform':59B 'infrastructur':30B 'modifi':57B 'proper':44B 'reach':63B 'read':55B 'remot':48B 'self':32B 'self-host':31B 'sensit':58B 'valid':52B 'version':37B","search_c":"'12.1.0.0':67C '12.1.1.2':69C 'access':81C 'allow':71C 'api':65C 'attack':75C 'authent':74C 'author':78C,89C 'bypass':77C 'check':79C 'connect':66C 'could':70C 'due':86C 'ibm':64C 'improp':88C 'inform':85C 'modifi':83C 'remot':73C 'sensit':84C","first_public_at":"2026-11-07T05:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17343","severity":null,"published_at":"2026-11-07T05:18:46+00:00","modified_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17343:2032","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:14:05+00:00","modified_at":"2026-11-07T06:14:05+00:00","first_seen_at":"2026-11-07T06:14:05+00:00","fetched_at":"2026-11-07T06:14:05+00:00","note":"Read IBM bulletin node/7295635: CVE-2026-17343 CWE-863, CVSS 8.1, affects API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, no workarounds. No exploitation info; X not searched (low-signal, B tier).","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}