{"id":"CVE-2026-18689","kind":"vulnerability","aliases":["CVE-2026-18689"],"related":[],"title":"IBM API Connect: authenticated users can see other organizations' names","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.","summary":"IBM API Connect accepts a token issued for a limited purpose where it should refuse it, so an authenticated user can learn the names of other organizations on the platform. The exposure is limited to organization names, not the contents of their APIs.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["single-organization","unaffected-version"],"how_to_check":"- Confirm the installed IBM API Connect version with the product's own admin console or CLI; `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2` are the affected ranges","fix":"- Move to a release newer than the affected ranges: `10.0.8.12` for the 10.0.8 line is not fixed; a fixed version is not stated in the sources","status":"open","published_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:54:25+00:00","updated_at":"2026-11-07T05:54:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:54:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than the affected ranges: `10.0.8.12` for the 10.0.8 line is not fixed; a fixed version is not stated in the sources\n- unknown","reach":"network","title":"IBM API Connect: authenticated users can see other organizations' names","impact":"low","summary":"IBM API Connect accepts a token issued for a limited purpose where it should refuse it, so an authenticated user can learn the names of other organizations on the platform. The exposure is limited to organization names, not the contents of their APIs.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","self-hosted","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads names of other organizations","analyst_note":"Find the IBM security bulletin for CVE-2026-18689 to confirm the fixed versions for both affected lines and any configuration check.","how_to_check":"- Confirm the installed IBM API Connect version with the product's own admin console or CLI; `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2` are the affected ranges\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","single-organization"],"who_is_affected":"Teams running a multi-organization IBM API Connect deployment where users from one organization can log in. Single-organization or non-affected version installs are less exposed. The sources do not name a fixed version or a specific configuration check.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4259,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18689':13A,16A '-2026':12A,15A '10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'accept':31B,105C 'allow':82C 'api':2A,18B,22B,29B,70B,72C 'api-gateway':17B 'authent':4A,46B,84C 'author':96C 'connect':3A,23B,30B,73C 'content':67B 'could':81C,112C 'cve':11A,14A 'due':93C 'exposur':59B 'gateway':19B 'host':27B 'ibm':1A,21B,28B,71C 'ibm-api-connect':20B 'incorrect':95C 'inform':89C 'infrastructur':24B 'issu':34B,99C 'learn':49B 'limit':37B,61B,88C,102C 'name':10A,51B,64B,115C 'obtain':87C 'organ':9A,54B,63B,92C,118C 'platform':57B 'purpos':38B,103C 'refus':42B 'reveal':113C 'see':7A 'self':26B 'self-host':25B 'token':33B,98C 'user':5A,47B,85C","nicknames":[],"mitigations":[],"who_affected":"Teams running a multi-organization IBM API Connect deployment where users from one organization can log in. Single-organization or non-affected version installs are less exposed. The sources do not name a fixed version or a specific configuration check.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","ibmapiconnect","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-18689':13A,16A '-2026':12A,15A 'api':2A 'authent':4A 'connect':3A 'cve':11A,14A 'ibm':1A 'name':10A 'organ':9A 'see':7A 'user':5A","search_b":"'accept':31B 'api':18B,22B,29B,70B 'api-gateway':17B 'authent':46B 'connect':23B,30B 'content':67B 'exposur':59B 'gateway':19B 'host':27B 'ibm':21B,28B 'ibm-api-connect':20B 'infrastructur':24B 'issu':34B 'learn':49B 'limit':37B,61B 'name':51B,64B 'organ':54B,63B 'platform':57B 'purpos':38B 'refus':42B 'self':26B 'self-host':25B 'token':33B 'user':47B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'accept':105C 'allow':82C 'api':72C 'authent':84C 'author':96C 'connect':73C 'could':81C,112C 'due':93C 'ibm':71C 'incorrect':95C 'inform':89C 'issu':99C 'limit':88C,102C 'name':115C 'obtain':87C 'organ':92C,118C 'purpos':103C 'reveal':113C 'token':98C 'user':85C","first_public_at":"2026-11-07T05:18:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18689","severity":null,"published_at":"2026-11-07T05:18:59+00:00","modified_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}