{"id":"CVE-2026-17378","kind":"vulnerability","aliases":["CVE-2026-17378"],"related":[],"title":"IBM API Connect: broken authorization exposes sensitive data to logged-in users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can read sensitive information belonging to other objects.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-connect","ibm","infrastructure","self-hosted"],"not_affected_if":["fixed-version","version-outside-range"],"how_to_check":"Check your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12, or (V12 OnPrem) 12.1.0.0 through 12.1.1.2. Fixed in 10.0.8.13 and v12.1.1.3.","fix":"Upgrade to IBM API Connect 10.0.8.13 (10.0.8 line) or v12.1.1.3 (12.1 line). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:35+00:00","updated_at":"2026-11-07T06:10:11+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-07T05:50:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: broken authorization exposes sensitive data to logged-in users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can read sensitive information belonging to other objects.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm","api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information of other objects","analyst_note":"Check the IBM security bulletin for API Connect fixed versions and any configuration details; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges are exposed, and only to users who already hold an account on the platform. Deployments on versions outside those ranges are not affected. The sources do not say which configurations are affected beyond the version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4226,"output_tokens":536,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for API Connect fixed versions and any configuration details; the NVD entry alone gives no fix.","search":"'-17378':16A,19A '-2026':15A,18A '10.0.8.0':38B,70C '10.0.8.12':40B,72C '12.1.0.0':42B,74C '12.1.1.2':44B,76C 'account':58B 'allow':78C 'api':2A,20A,22A,27B,35B,68C 'api-connect':26B 'attack':54B,82C 'authent':81C 'author':5A,51B,93C 'belong':63B 'broken':4A,89C 'check':47B 'connect':3A,21A,23A,28B,36B,69C 'could':77C 'cve':14A,17A 'data':8A 'due':87C 'expos':6A 'fail':45B 'host':33B 'ibm':1A,29B,34B,67C 'inform':62B,86C 'infrastructur':30B 'level':50B,92C 'log':11A 'logged-in':10A 'object':49B,66B,91C 'object-level':48B,90C 'obtain':84C 'onprem':25A 'read':60B 'remot':53B,80C 'self':32B 'self-host':31B 'sensit':7A,61B,85C 'user':13A 'v12':24A 'valid':57B 'version':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2 (IBM's V12 table lists OnPrem) are exposed. An attacker needs a valid account on the platform, then can read sensitive information belonging to other objects because of broken object-level authorization (CWE-639 in the v12.1 bulletin, CWE-863 in the 10.0.8 bulletin). Deployments on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:10:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2019},"products":{"at":"2026-11-07T06:10:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2019},"workarounds":{"at":"2026-11-07T06:10:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2019},"how_to_check":{"at":"2026-11-07T06:10:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2019},"who_affected":{"at":"2026-11-07T06:10:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2019}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apiconnect","high","ibm","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17378':16A,19A '-2026':15A,18A 'api':2A,20A,22A 'author':5A 'broken':4A 'connect':3A,21A,23A 'cve':14A,17A 'data':8A 'expos':6A 'ibm':1A 'log':11A 'logged-in':10A 'onprem':25A 'sensit':7A 'user':13A 'v12':24A","search_b":"'10.0.8.0':38B '10.0.8.12':40B '12.1.0.0':42B '12.1.1.2':44B 'account':58B 'api':27B,35B 'api-connect':26B 'attack':54B 'author':51B 'belong':63B 'check':47B 'connect':28B,36B 'fail':45B 'host':33B 'ibm':29B,34B 'inform':62B 'infrastructur':30B 'level':50B 'object':49B,66B 'object-level':48B 'read':60B 'remot':53B 'self':32B 'self-host':31B 'sensit':61B 'valid':57B 'version':37B","search_c":"'10.0.8.0':70C '10.0.8.12':72C '12.1.0.0':74C '12.1.1.2':76C 'allow':78C 'api':68C 'attack':82C 'authent':81C 'author':93C 'broken':89C 'connect':69C 'could':77C 'due':87C 'ibm':67C 'inform':86C 'level':92C 'object':91C 'object-level':90C 'obtain':84C 'remot':80C 'sensit':85C","first_public_at":"2026-11-07T05:18:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17378","severity":null,"published_at":"2026-11-07T05:18:51+00:00","modified_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17378:2019","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:10:11+00:00","modified_at":"2026-11-07T06:10:11+00:00","first_seen_at":"2026-11-07T06:10:11+00:00","fetched_at":"2026-11-07T06:10:11+00:00","note":"Read both IBM bulletins (-39 for v12.1.1.3, -41 for 10.0.8.13); CVE listed in each, no workarounds, no exploitation reported. The 10.0.8 page metadata says V10.0.8.0-V10.0.8.13 but its table and text say .12 and the fix is .13.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}