{"id":"CVE-2026-17376","kind":"vulnerability","aliases":["CVE-2026-17376"],"related":[],"title":"IBM API Connect: broken authorization lets logged-in users read sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can obtain sensitive information belonging to other users or objects.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["fixed-version","no-authenticated-users","unaffected-version","version-outside-range"],"how_to_check":"Check your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 (self-hosted). Fixed in 10.0.8.13 and 12.1.1.3. Any authenticated account can reach it, so review who holds accounts on the manager.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13; upgrade 12.1.x to 12.1.1.3 (IBM Fix Central). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:50+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:37+00:00","updated_at":"2026-11-07T06:09:54+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:50:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: broken authorization lets logged-in users read sensitive data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can obtain sensitive information belonging to other users or objects.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive data of other objects","analyst_note":"Check the IBM security bulletin for the fixed versions and any required setting; the NVD entry alone does not give a fix.","how_to_check":"- Check the installed API Connect version in the product's management console or release notes.\n- Compare it against the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-users"],"who_is_affected":"Organizations running IBM API Connect 10.0.8.x up to 10.0.8.12 or 12.1.x up to 12.1.1.2. Exposure requires an authenticated account on the API Connect deployment; installations on other versions are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4226,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for the fixed versions and any required setting; the NVD entry alone does not give a fix.","search":"'-17376':16A,19A '-2026':15A,18A '10.0.8.0':43B,77C '10.0.8.12':45B,79C '12.1.0.0':47B,81C '12.1.1.2':49B,83C 'account':63B 'allow':85C 'api':2A,21A,24A,28B,33B,40B,75C 'api-gateway':27B 'attack':59B,89C 'authent':30B,88C 'author':5A,56B,100C 'belong':68B 'broken':4A,96C 'check':52B 'connect':3A,22A,25A,34B,41B,76C 'could':84C 'cve':14A,17A 'data':13A 'due':94C 'fail':50B 'gateway':29B 'host':38B 'ibm':1A,20A,23A,32B,39B,74C 'ibm-api-connect':31B 'inform':67B,93C 'infrastructur':35B 'let':6A 'level':55B,99C 'log':8A 'logged-in':7A 'object':54B,73B,98C 'object-level':53B,97C 'obtain':65B,91C 'read':11A 'remot':58B,87C 'self':37B 'self-host':36B 'sensit':12A,66B,92C 'user':10A,71B 'v12':26A 'valid':62B 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect themselves on 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2. Any logged-in user could read sensitive data belonging to other users or objects, because object-level authorization is not checked (CWE-639). Needs a valid account, no user interaction. IBM does not say which endpoints are involved. Versions 10.0.8.13 / 12.1.1.3 and later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:09:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2020},"products":{"at":"2026-11-07T06:09:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2020},"how_to_check":{"at":"2026-11-07T06:09:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2020},"who_affected":{"at":"2026-11-07T06:09:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2020}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12","ibmapiconnect","ibmapiconnectv12"],"ptokens":["api","connect","ibm","v12"],"labels":["apigateway","authenticated","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17376':16A,19A '-2026':15A,18A 'api':2A,21A,24A 'author':5A 'broken':4A 'connect':3A,22A,25A 'cve':14A,17A 'data':13A 'ibm':1A,20A,23A 'let':6A 'log':8A 'logged-in':7A 'read':11A 'sensit':12A 'user':10A 'v12':26A","search_b":"'10.0.8.0':43B '10.0.8.12':45B '12.1.0.0':47B '12.1.1.2':49B 'account':63B 'api':28B,33B,40B 'api-gateway':27B 'attack':59B 'authent':30B 'author':56B 'belong':68B 'check':52B 'connect':34B,41B 'fail':50B 'gateway':29B 'host':38B 'ibm':32B,39B 'ibm-api-connect':31B 'inform':67B 'infrastructur':35B 'level':55B 'object':54B,73B 'object-level':53B 'obtain':65B 'remot':58B 'self':37B 'self-host':36B 'sensit':66B 'user':71B 'valid':62B 'version':42B","search_c":"'10.0.8.0':77C '10.0.8.12':79C '12.1.0.0':81C '12.1.1.2':83C 'allow':85C 'api':75C 'attack':89C 'authent':88C 'author':100C 'broken':96C 'connect':76C 'could':84C 'due':94C 'ibm':74C 'inform':93C 'level':99C 'object':98C 'object-level':97C 'obtain':91C 'remot':87C 'sensit':92C","first_public_at":"2026-11-07T05:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17376","severity":null,"published_at":"2026-11-07T05:18:50+00:00","modified_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17376:2020","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:09:54+00:00","modified_at":"2026-11-07T06:09:54+00:00","first_seen_at":"2026-11-07T06:09:54+00:00","fetched_at":"2026-11-07T06:09:54+00:00","note":"Read IBM bulletins -41 (10.0.8.13) and -39 (v12.1.1.3): CVE listed, CWE-639, CVSS 7.7, no workaround. -41 metadata says up to 10.0.8.13 but its table says 10.0.8.0-12. -39 had no readable affected table; 12.1.1.3 fix from its summary and NVD/IBM solution text. No exploitation/PoC checked; endpoints not named.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}