{"id":"CVE-2026-17391","kind":"vulnerability","aliases":["CVE-2026-17391"],"related":[],"title":"IBM API Connect: broken authorization lets logged-in users read sensitive data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can obtain sensitive information belonging to other objects.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","vendor"],"not_affected_if":["no-authenticated-user-access","outside-affected-versions"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- Review the IBM security bulletin for API Connect for the affected component list (unknown from the sources)","fix":"- Move to a release newer than the affected ranges (exact fixed version unknown from the sources)","status":"open","published_at":"2026-11-07T05:18:53+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:52:46+00:00","updated_at":"2026-11-07T05:52:46+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than the affected ranges (exact fixed version unknown from the sources)","reach":"network","title":"IBM API Connect: broken authorization lets logged-in users read sensitive data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fail to check object-level authorization. A remote attacker with a valid account can obtain sensitive information belonging to other objects.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads sensitive data belonging to other objects","analyst_note":"Find the IBM security bulletin for CVE-2026-17391 to confirm the fixed version and affected components.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- Review the IBM security bulletin for API Connect for the affected component list (unknown from the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions","no-authenticated-user-access"],"who_is_affected":"Organizations running IBM API Connect 10.0.8.x or 12.1.x in the affected ranges. The attacker needs a valid account on the platform, so exposure depends on who can log in and how the management or developer portal is reachable. Deployments outside those version ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4227,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17391':16A,19A '-2026':15A,18A '10.0.8.0':32B,64C '10.0.8.12':34B,66C '12.1.0.0':36B,68C '12.1.1.2':38B,70C 'account':52B 'allow':72C 'api':2A,21B,25B,29B,62C 'api-gateway':20B 'attack':48B,76C 'authent':75C 'author':5A,45B,87C 'belong':57B 'broken':4A,83C 'check':41B 'connect':3A,26B,30B,63C 'could':71C 'cve':14A,17A 'data':13A 'due':81C 'fail':39B 'gateway':22B 'ibm':1A,24B,28B,61C 'ibm-api-connect':23B 'inform':56B,80C 'let':6A 'level':44B,86C 'log':8A 'logged-in':7A 'object':43B,60B,85C 'object-level':42B,84C 'obtain':54B,78C 'read':11A 'remot':47B,74C 'sensit':12A,55B,79C 'user':10A 'valid':51B 'vendor':27B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 10.0.8.x or 12.1.x in the affected ranges. The attacker needs a valid account on the platform, so exposure depends on who can log in and how the management or developer portal is reachable. Deployments outside those version ranges are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","medium","vendor"],"campaign_type":null,"search_a":"'-17391':16A,19A '-2026':15A,18A 'api':2A 'author':5A 'broken':4A 'connect':3A 'cve':14A,17A 'data':13A 'ibm':1A 'let':6A 'log':8A 'logged-in':7A 'read':11A 'sensit':12A 'user':10A","search_b":"'10.0.8.0':32B '10.0.8.12':34B '12.1.0.0':36B '12.1.1.2':38B 'account':52B 'api':21B,25B,29B 'api-gateway':20B 'attack':48B 'author':45B 'belong':57B 'check':41B 'connect':26B,30B 'fail':39B 'gateway':22B 'ibm':24B,28B 'ibm-api-connect':23B 'inform':56B 'level':44B 'object':43B,60B 'object-level':42B 'obtain':54B 'remot':47B 'sensit':55B 'valid':51B 'vendor':27B 'version':31B","search_c":"'10.0.8.0':64C '10.0.8.12':66C '12.1.0.0':68C '12.1.1.2':70C 'allow':72C 'api':62C 'attack':76C 'authent':75C 'author':87C 'broken':83C 'connect':63C 'could':71C 'due':81C 'ibm':61C 'inform':80C 'level':86C 'object':85C 'object-level':84C 'obtain':78C 'remot':74C 'sensit':79C","first_public_at":"2026-11-07T05:18:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17391","severity":null,"published_at":"2026-11-07T05:18:53+00:00","modified_at":"2026-11-07T05:18:54+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}