{"id":"CVE-2026-19121","kind":"vulnerability","aliases":["CVE-2026-19121"],"related":[],"title":"IBM API Connect: authenticated users can reach other tenants' resources","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not check that a signed-in user belongs to the tenant they are acting in. A logged-in attacker can gain unauthorized access to another tenant's resources.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","multi-tenant","self-hosted","vendor"],"not_affected_if":["outside-affected-range","single-tenant"],"how_to_check":"Check your IBM API Connect V12 OnPrem version: affected if v12.1.0.0 through v12.1.1.2; fixed in v12.1.1.3. IBM lists no setting that limits exposure and no workaround.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:50:23+00:00","updated_at":"2026-11-07T06:03:31+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can reach other tenants' resources","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not check that a signed-in user belongs to the tenant they are acting in. A logged-in attacker can gain unauthorized access to another tenant's resources.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","multi-tenant","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker reads another tenant's API resources","analyst_note":"Confirm the fixed version and any tenant-isolation setting from the IBM security bulletin for CVE-2026-19121; the NVD entry alone does not state them.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-range","single-tenant"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 with more than one tenant are exposed, since the flaw lets one tenant reach another's resources. Attackers need a valid account on the platform first. Single-tenant deployments are unlikely to be affected in a meaningful way, but the sources do not say this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4226,"output_tokens":566,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any tenant-isolation setting from the IBM security bulletin for CVE-2026-19121; the NVD entry alone does not state them.","search":"'-19121':13A,16A '-2026':12A,15A '12.1.0.0':39B,76C '12.1.1.2':41B,78C 'access':67B,87C,105C 'act':57B 'allow':80C,104C 'anoth':69B,107C 'api':2A,17A,22B,26B,36B,74C 'api-gateway':21B 'attack':63B,83C 'authent':4A,82C,100C 'author':91C 'belong':51B 'check':44B 'connect':3A,18A,27B,37B,75C 'context':93C 'could':79C,103C 'cve':11A,14A 'due':88C 'gain':65B,85C 'gateway':23B 'host':33B 'ibm':1A,25B,35B,73C 'ibm-api-connect':24B 'improp':90C 'log':61B 'logged-in':60B 'multi':29B 'multi-ten':28B 'onprem':20A 'reach':7A 'resourc':10A,72B,110C 'self':32B 'self-host':31B 'sign':48B 'signed-in':47B 'suffici':96C 'tenant':9A,30B,54B,70B,92C,108C 'unauthor':66B,86C 'user':5A,50B,101C 'v12':19A 'vendor':34B 'verifi':97C 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed (OnPrem) IBM API Connect V12, versions 12.1.0.0 through 12.1.1.2, with more than one tenant are exposed: a logged-in user can reach another tenant's resources because tenant context is not checked against the user. IBM lists no workaround, so upgrade to 12.1.1.3. IBM does not list other versions as affected.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:03:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2002},"products":{"at":"2026-11-07T06:03:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2002},"workarounds":{"at":"2026-11-07T06:03:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2002},"how_to_check":{"at":"2026-11-07T06:03:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2002}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","multitenant","selfhosted","vendor"],"campaign_type":null,"search_a":"'-19121':13A,16A '-2026':12A,15A 'api':2A,17A 'authent':4A 'connect':3A,18A 'cve':11A,14A 'ibm':1A 'onprem':20A 'reach':7A 'resourc':10A 'tenant':9A 'user':5A 'v12':19A","search_b":"'12.1.0.0':39B '12.1.1.2':41B 'access':67B 'act':57B 'anoth':69B 'api':22B,26B,36B 'api-gateway':21B 'attack':63B 'belong':51B 'check':44B 'connect':27B,37B 'gain':65B 'gateway':23B 'host':33B 'ibm':25B,35B 'ibm-api-connect':24B 'log':61B 'logged-in':60B 'multi':29B 'multi-ten':28B 'resourc':72B 'self':32B 'self-host':31B 'sign':48B 'signed-in':47B 'tenant':30B,54B,70B 'unauthor':66B 'user':50B 'vendor':34B 'version':38B","search_c":"'12.1.0.0':76C '12.1.1.2':78C 'access':87C,105C 'allow':80C,104C 'anoth':107C 'api':74C 'attack':83C 'authent':82C,100C 'author':91C 'connect':75C 'context':93C 'could':79C,103C 'due':88C 'gain':85C 'ibm':73C 'improp':90C 'resourc':110C 'suffici':96C 'tenant':92C,108C 'unauthor':86C 'user':101C 'verifi':97C","first_public_at":"2026-11-07T05:18:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19121","severity":null,"published_at":"2026-11-07T05:18:59+00:00","modified_at":"2026-11-07T05:19:00+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-19121:2002","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:03:31+00:00","modified_at":"2026-11-07T06:03:31+00:00","first_seen_at":"2026-11-07T06:03:31+00:00","fetched_at":"2026-11-07T06:03:31+00:00","note":"IBM bulletin node/7295635 lists CVE-2026-19121 (CVSS 8.3): affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds None. No tenant-isolation setting mentioned. Exploitation/PoC not checked beyond NVD/KEV absence.","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}