{"id":"CVE-2026-17428","kind":"vulnerability","aliases":["CVE-2026-17428"],"related":[],"title":"IBM API Connect: authorization flaw exposes other users' information to attackers","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 trust values in the request URL when making authorization decisions. A remote attacker with a valid account can read information that belongs to other users.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure"],"not_affected_if":["outside-affected-versions"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2","fix":null,"status":"open","published_at":"2026-11-07T05:18:58+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:54:16+00:00","updated_at":"2026-11-07T05:54:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:54:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authorization flaw exposes other users' information to attackers","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 trust values in the request URL when making authorization decisions. A remote attacker with a valid account can read information that belongs to other users.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads other users' sensitive information","analyst_note":"Confirm the fixed versions and any configuration conditions from the IBM security bulletin for CVE-2026-17428; the sources only give the affected ranges.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where authenticated users can reach APIs that return data by identifiers in the URL. Deployments on versions outside the listed ranges are not affected. The sources do not describe further configuration conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4264,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17428':14A,17A '-2026':13A,16A '10.0.8.0':30B,65C '10.0.8.12':32B,67C '12.1.0.0':34B,69C '12.1.1.2':36B,71C 'access':103C 'account':53B 'allow':73C,102C 'api':2A,19B,23B,27B,63C 'api-gateway':18B 'attack':11A,49B,77C 'authent':76C 'author':4A,45B,85C,95C 'belong':58B,106C 'connect':3A,24B,28B,64C 'could':72C,101C 'cve':12A,15A 'decis':46B,96C 'due':82C 'expos':6A 'flaw':5A 'gateway':20B 'ibm':1A,22B,26B,62C 'ibm-api-connect':21B 'improp':84C 'inform':9A,56B,81C,105C 'infrastructur':25B 'make':44B 'obtain':79C 'other':108C 'read':55B 'remot':48B,75C 'request':41B,90C 'sensit':80C 'suffici':98C 'suppli':87C 'trust':37B 'url':42B,91C 'use':93C 'user':8A,61B 'valid':52B 'valu':38B,86C 'verif':99C 'version':29B 'without':97C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where authenticated users can reach APIs that return data by identifiers in the URL. Deployments on versions outside the listed ranges are not affected. The sources do not describe further configuration conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium"],"campaign_type":null,"search_a":"'-17428':14A,17A '-2026':13A,16A 'api':2A 'attack':11A 'author':4A 'connect':3A 'cve':12A,15A 'expos':6A 'flaw':5A 'ibm':1A 'inform':9A 'user':8A","search_b":"'10.0.8.0':30B '10.0.8.12':32B '12.1.0.0':34B '12.1.1.2':36B 'account':53B 'api':19B,23B,27B 'api-gateway':18B 'attack':49B 'author':45B 'belong':58B 'connect':24B,28B 'decis':46B 'gateway':20B 'ibm':22B,26B 'ibm-api-connect':21B 'inform':56B 'infrastructur':25B 'make':44B 'read':55B 'remot':48B 'request':41B 'trust':37B 'url':42B 'user':61B 'valid':52B 'valu':38B 'version':29B","search_c":"'10.0.8.0':65C '10.0.8.12':67C '12.1.0.0':69C '12.1.1.2':71C 'access':103C 'allow':73C,102C 'api':63C 'attack':77C 'authent':76C 'author':85C,95C 'belong':106C 'connect':64C 'could':72C,101C 'decis':96C 'due':82C 'ibm':62C 'improp':84C 'inform':81C,105C 'obtain':79C 'other':108C 'remot':75C 'request':90C 'sensit':80C 'suffici':98C 'suppli':87C 'url':91C 'use':93C 'valu':86C 'verif':99C 'without':97C","first_public_at":"2026-11-07T05:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17428","severity":null,"published_at":"2026-11-07T05:18:58+00:00","modified_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}