{"id":"CVE-2026-17366","kind":"vulnerability","aliases":["CVE-2026-17366"],"related":[],"title":"IBM API Connect: broken authorization lets logged-in users read sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 check object-level permissions incorrectly. A remote attacker with a valid account can obtain sensitive information belonging to other objects.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed IBM API Connect version in the management console or product documentation; affected ranges are `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`.","fix":"- Upgrade to a release beyond the affected ranges; the specific fixed version is unknown from the sources.","status":"open","published_at":"2026-11-07T05:18:49+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:54:19+00:00","updated_at":"2026-11-07T05:54:19+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a release beyond the affected ranges; the specific fixed version is unknown from the sources.","reach":"network","title":"IBM API Connect: broken authorization lets logged-in users read sensitive data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 check object-level permissions incorrectly. A remote attacker with a valid account can obtain sensitive information belonging to other objects.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive data of other objects","analyst_note":"Confirm the fixed version and whether a patch exists in IBM's security bulletin for CVE-2026-17366.","how_to_check":"- Check the installed IBM API Connect version in the management console or product documentation; affected ranges are `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed to authenticated users reaching objects they should not see. Systems running other versions or without API Connect deployments can skip it. Whether the flaw is reachable depends on which users hold accounts on the gateway or management interface.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4227,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17366':16A,19A '-2026':15A,18A '10.0.8.0':32B,63C '10.0.8.12':34B,65C '12.1.0.0':36B,67C '12.1.1.2':38B,69C 'account':51B 'allow':71C 'api':2A,21B,25B,29B,61C 'api-gateway':20B 'attack':47B,75C 'authent':74C 'author':5A,86C 'belong':56B 'broken':4A,82C 'check':39B 'connect':3A,26B,30B,62C 'could':70C 'cve':14A,17A 'data':13A 'due':80C 'gateway':22B 'ibm':1A,24B,28B,60C 'ibm-api-connect':23B 'incorrect':44B 'inform':55B,79C 'let':6A 'level':42B,85C 'log':8A 'logged-in':7A 'object':41B,59B,84C 'object-level':40B,83C 'obtain':53B,77C 'permiss':43B 'read':11A 'remot':46B,73C 'sensit':12A,54B,78C 'user':10A 'valid':50B 'vendor':27B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges are exposed to authenticated users reaching objects they should not see. Systems running other versions or without API Connect deployments can skip it. Whether the flaw is reachable depends on which users hold accounts on the gateway or management interface.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","vendor"],"campaign_type":null,"search_a":"'-17366':16A,19A '-2026':15A,18A 'api':2A 'author':5A 'broken':4A 'connect':3A 'cve':14A,17A 'data':13A 'ibm':1A 'let':6A 'log':8A 'logged-in':7A 'read':11A 'sensit':12A 'user':10A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'account':51B 'api':21B,25B,29B 'api-gateway':20B 'attack':47B 'belong':56B 'check':39B 'connect':26B,30B 'gateway':22B 'ibm':24B,28B 'ibm-api-connect':23B 'incorrect':44B 'inform':55B 'level':42B 'object':41B,59B 'object-level':40B 'obtain':53B 'permiss':43B 'remot':46B 'sensit':54B 'valid':50B 'vendor':27B 'version':31B","search_c":"'10.0.8.0':63C '10.0.8.12':65C '12.1.0.0':67C '12.1.1.2':69C 'allow':71C 'api':61C 'attack':75C 'authent':74C 'author':86C 'broken':82C 'connect':62C 'could':70C 'due':80C 'ibm':60C 'inform':79C 'level':85C 'object':84C 'object-level':83C 'obtain':77C 'remot':73C 'sensit':78C","first_public_at":"2026-11-07T05:18:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17366","severity":null,"published_at":"2026-11-07T05:18:49+00:00","modified_at":"2026-11-07T05:18:49+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}