{"id":"CVE-2026-17387","kind":"vulnerability","aliases":["CVE-2026-17387"],"related":[],"title":"IBM API Connect: broken object-level authorization exposes sensitive information to users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level permissions. A remote attacker with a valid account can read sensitive information they should not see.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed IBM API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":"- Move to a fixed version: unknown, the sources do not state it","status":"open","published_at":"2026-11-07T05:18:53+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:34+00:00","updated_at":"2026-11-07T05:50:34+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:50:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed version: unknown, the sources do not state it","reach":"network","title":"IBM API Connect: broken object-level authorization exposes sensitive information to users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level permissions. A remote attacker with a valid account can read sensitive information they should not see.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information belonging to others","analyst_note":"Find IBM's security bulletin for CVE-2026-17387 to confirm the fixed versions and which data objects are exposed.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold authenticated accounts. The sources do not describe the specific configuration that exposes the data, so exposure beyond the version ranges is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4226,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17387':16A,19A '-2026':15A,18A '10.0.8.0':32B,64C '10.0.8.12':34B,66C '12.1.0.0':36B,68C '12.1.1.2':38B,70C 'account':52B 'allow':72C 'api':2A,21B,25B,29B,62C 'api-gateway':20B 'attack':48B,76C 'authent':75C 'author':8A,87C 'broken':4A,83C 'check':41B 'connect':3A,26B,30B,63C 'could':71C 'cve':14A,17A 'due':81C 'expos':9A 'fail':39B 'gateway':22B 'ibm':1A,24B,28B,61C 'ibm-api-connect':23B 'inform':11A,56B,80C 'level':7A,44B,86C 'object':6A,43B,85C 'object-level':5A,42B,84C 'obtain':78C 'permiss':45B 'read':54B 'remot':47B,74C 'see':60B 'sensit':10A,55B,79C 'user':13A 'valid':51B 'vendor':27B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold authenticated accounts. The sources do not describe the specific configuration that exposes the data, so exposure beyond the version ranges is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","high","ibmapiconnect","vendor"],"campaign_type":null,"search_a":"'-17387':16A,19A '-2026':15A,18A 'api':2A 'author':8A 'broken':4A 'connect':3A 'cve':14A,17A 'expos':9A 'ibm':1A 'inform':11A 'level':7A 'object':6A 'object-level':5A 'sensit':10A 'user':13A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'account':52B 'api':21B,25B,29B 'api-gateway':20B 'attack':48B 'check':41B 'connect':26B,30B 'fail':39B 'gateway':22B 'ibm':24B,28B 'ibm-api-connect':23B 'inform':56B 'level':44B 'object':43B 'object-level':42B 'permiss':45B 'read':54B 'remot':47B 'see':60B 'sensit':55B 'valid':51B 'vendor':27B 'version':31B","search_c":"'10.0.8.0':64C '10.0.8.12':66C '12.1.0.0':68C '12.1.1.2':70C 'allow':72C 'api':62C 'attack':76C 'authent':75C 'author':87C 'broken':83C 'connect':63C 'could':71C 'due':81C 'ibm':61C 'inform':80C 'level':86C 'object':85C 'object-level':84C 'obtain':78C 'remot':74C 'sensit':79C","first_public_at":"2026-11-07T05:18:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17387","severity":null,"published_at":"2026-11-07T05:18:53+00:00","modified_at":"2026-11-07T05:18:53+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}