{"id":"CVE-2026-17371","kind":"vulnerability","aliases":["CVE-2026-17371"],"related":[],"title":"IBM API Connect: broken object-level authorization leaks sensitive information to users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level permissions. A logged-in attacker can read sensitive information belonging to other users or objects.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["no-untrusted-accounts","unaffected-version"],"how_to_check":"- Confirm whether IBM API Connect is deployed and note the version: `unknown` for the exact check command, the sources do not say.\n- Check whether the installed version falls in `10.0.8.0` through `10.0.8.12` or `12.1.0.0` through `12.1.1.2`.","fix":null,"status":"open","published_at":"2026-11-07T05:18:50+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:54:17+00:00","updated_at":"2026-11-07T05:54:17+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:54:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: broken object-level authorization leaks sensitive information to users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level permissions. A logged-in attacker can read sensitive information belonging to other users or objects.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads sensitive data from other objects","analyst_note":"Find the IBM security bulletin for CVE-2026-17371 to get the fixed version and affected endpoints; the NVD entry gives only the range.","how_to_check":"- Confirm whether IBM API Connect is deployed and note the version: `unknown` for the exact check command, the sources do not say.\n- Check whether the installed version falls in `10.0.8.0` through `10.0.8.12` or `12.1.0.0` through `12.1.1.2`.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-untrusted-accounts"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges, where authenticated users can reach API objects they should not see. Exposure depends on who holds accounts on the platform; installations without untrusted authenticated users are less exposed. The sources do not describe the specific endpoints or default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4227,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17371':16A,19A '-2026':15A,18A '10.0.8.0':32B,64C '10.0.8.12':34B,66C '12.1.0.0':36B,68C '12.1.1.2':38B,70C 'allow':72C 'api':2A,22B,29B,62C 'attack':50B,76C 'authent':75C 'author':8A,87C 'belong':55B 'broken':4A,83C 'check':41B 'connect':3A,23B,30B,63C 'could':71C 'cve':14A,17A 'due':81C 'fail':39B 'host':26B 'ibm':1A,21B,28B,61C 'ibm-api-connect':20B 'inform':11A,54B,80C 'leak':9A 'level':7A,44B,86C 'log':48B 'logged-in':47B 'object':6A,43B,60B,85C 'object-level':5A,42B,84C 'obtain':78C 'permiss':45B 'read':52B 'remot':74C 'self':25B 'self-host':24B 'sensit':10A,53B,79C 'user':13A,58B 'vendor':27B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect in the affected version ranges, where authenticated users can reach API objects they should not see. Exposure depends on who holds accounts on the platform; installations without untrusted authenticated users are less exposed. The sources do not describe the specific endpoints or default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17371':16A,19A '-2026':15A,18A 'api':2A 'author':8A 'broken':4A 'connect':3A 'cve':14A,17A 'ibm':1A 'inform':11A 'leak':9A 'level':7A 'object':6A 'object-level':5A 'sensit':10A 'user':13A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'api':22B,29B 'attack':50B 'belong':55B 'check':41B 'connect':23B,30B 'fail':39B 'host':26B 'ibm':21B,28B 'ibm-api-connect':20B 'inform':54B 'level':44B 'log':48B 'logged-in':47B 'object':43B,60B 'object-level':42B 'permiss':45B 'read':52B 'self':25B 'self-host':24B 'sensit':53B 'user':58B 'vendor':27B 'version':31B","search_c":"'10.0.8.0':64C '10.0.8.12':66C '12.1.0.0':68C '12.1.1.2':70C 'allow':72C 'api':62C 'attack':76C 'authent':75C 'author':87C 'broken':83C 'connect':63C 'could':71C 'due':81C 'ibm':61C 'inform':80C 'level':86C 'object':85C 'object-level':84C 'obtain':78C 'remot':74C 'sensit':79C","first_public_at":"2026-11-07T05:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17371","severity":null,"published_at":"2026-11-07T05:18:50+00:00","modified_at":"2026-11-07T05:18:50+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}