---
id: "CVE-2026-18689"
page: "https://infrastack.ai/live/CVE-2026-18689"
kind: "vulnerability"
aliases: ["CVE-2026-18689"]
title: "IBM API Connect: authenticated users can see other organizations' names"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "infrastructure", "self-hosted"]
not_affected_if: ["single-organization", "unaffected-version"]
published_at: "2026-11-07T05:18:59+00:00"
first_seen_at: "2026-11-07T05:46:08+00:00"
updated_at: "2026-11-07T05:54:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18689", "first_seen_at": "2026-11-07T05:46:08+00:00"}]
exploit_sources: []
---

# IBM API Connect: authenticated users can see other organizations' names

Link for people: https://infrastack.ai/live/CVE-2026-18689 (this .md is for agents)

IBM API Connect accepts a token issued for a limited purpose where it should refuse it, so an authenticated user can learn the names of other organizations on the platform. The exposure is limited to organization names, not the contents of their APIs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed IBM API Connect version with the product's own admin console or CLI; `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2` are the affected ranges

## Fix

- Move to a release newer than the affected ranges: `10.0.8.12` for the 10.0.8 line is not fixed; a fixed version is not stated in the sources

## Timeline

- 2026-11-07T05:46:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18689

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_