{"id":"CVE-2026-17375","kind":"vulnerability","aliases":["CVE-2026-17375"],"related":[],"title":"IBM API Connect: logged-in users can read data they should not see (CVE-2026-17375)","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 decide access using information supplied by the client. A logged-in attacker can use this to read information they should not be allowed to see.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["fixed-version","no-authenticated-users","version-outside-range"],"how_to_check":"Check your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 (self-hosted). Fixed in 10.0.8.13 and 12.1.1.3. Any authenticated account can reach it, so review who holds accounts on the manager.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13; upgrade 12.1.x to 12.1.1.3 (IBM Fix Central). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:50+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:38+00:00","updated_at":"2026-11-07T06:11:01+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: improper authorization exposes data to authenticated users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 decide access using information supplied by the client. A logged-in attacker can use this to read information they should not be allowed to see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information they should not see","analyst_note":"Check the IBM security bulletin for this CVE to confirm affected endpoints, the fixed version, and any workaround; NVD text alone gives no fix.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- Confirm whether untrusted or low-privilege user accounts exist on the API Connect deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges, where users with a valid account can reach the management or API features. Deployments on versions outside the listed ranges are not affected. The sources do not say which specific endpoints or roles are involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4254,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE to confirm affected endpoints, the fixed version, and any workaround; NVD text alone gives no fix.","search":"'-17375':17A,20A,23A '-2026':16A,19A,22A '10.0.8.0':44B,80C '10.0.8.12':46B,82C '12.1.0.0':48B,84C '12.1.1.2':50B,86C 'access':52B,113C 'allow':74B,88C,112C 'api':2A,25A,28A,34B,41B,78C 'attack':63B,92C 'authent':31B,91C 'author':100C,101C 'client':58B,109C 'connect':3A,26A,29A,35B,42B,79C 'could':87C,111C 'cve':15A,18A,21A 'data':10A 'decid':51B 'decis':102C 'due':97C 'host':39B 'ibm':1A,24A,27A,33B,40B,77C 'ibm-api-connect':32B 'improp':99C 'inform':54B,69B,96C,105C,115C 'infrastructur':36B 'log':5A,61B 'logged-in':4A,60B 'obtain':94C 'read':9A,68B 'reli':103C 'remot':90C 'see':14A,76B,120C 'self':38B 'self-host':37B 'sensit':95C 'suppli':55B,106C 'use':53B,65B 'user':7A,117C 'v12':30A 'version':43B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect themselves on 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2. Any logged-in user could read information they should not see, because access decisions rely on client-supplied values (CWE-639). Needs a valid account, no user interaction. IBM does not name the endpoints. Versions 10.0.8.13 / 12.1.1.3 and later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:11:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2021},"products":{"at":"2026-11-07T06:11:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2021},"how_to_check":{"at":"2026-11-07T06:11:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2021},"who_affected":{"at":"2026-11-07T06:11:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2021}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12","ibmapiconnect","ibmapiconnectv12"],"ptokens":["api","connect","ibm","v12"],"labels":["authenticated","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17375':17A,20A,23A '-2026':16A,19A,22A 'api':2A,25A,28A 'connect':3A,26A,29A 'cve':15A,18A,21A 'data':10A 'ibm':1A,24A,27A 'log':5A 'logged-in':4A 'read':9A 'see':14A 'user':7A 'v12':30A","search_b":"'10.0.8.0':44B '10.0.8.12':46B '12.1.0.0':48B '12.1.1.2':50B 'access':52B 'allow':74B 'api':34B,41B 'attack':63B 'authent':31B 'client':58B 'connect':35B,42B 'decid':51B 'host':39B 'ibm':33B,40B 'ibm-api-connect':32B 'inform':54B,69B 'infrastructur':36B 'log':61B 'logged-in':60B 'read':68B 'see':76B 'self':38B 'self-host':37B 'suppli':55B 'use':53B,65B 'version':43B","search_c":"'10.0.8.0':80C '10.0.8.12':82C '12.1.0.0':84C '12.1.1.2':86C 'access':113C 'allow':88C,112C 'api':78C 'attack':92C 'authent':91C 'author':100C,101C 'client':109C 'connect':79C 'could':87C,111C 'decis':102C 'due':97C 'ibm':77C 'improp':99C 'inform':96C,105C,115C 'obtain':94C 'reli':103C 'remot':90C 'see':120C 'sensit':95C 'suppli':106C 'user':117C","first_public_at":"2026-11-07T05:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17375","severity":null,"published_at":"2026-11-07T05:18:50+00:00","modified_at":"2026-11-07T05:18:50+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17375:2021","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:11:01+00:00","modified_at":"2026-11-07T06:11:01+00:00","first_seen_at":"2026-11-07T06:11:01+00:00","fetched_at":"2026-11-07T06:11:01+00:00","note":"Read IBM bulletins -41 (10.0.8.13; table lists 10.0.8.0-12, metadata says up to .13) and -39 (v12.1.1.3; no affected table, 12.1.1.3 fix from summary; 12.1.0.0-12.1.1.2 range from NVD). CVSS 7.7, CWE-639, no workaround, endpoints not named. Exploitation/PoC/chatter not checked.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}