CVE-2026-17292

Summary

IBM API Connect has broken object-level authorization on organization ownership changes: authenticated low-privilege users can modify ownership of organizations they do not control due to incomplete access checks.

Exploitability

Requires a valid authenticated user account with any privilege level; exploitation is straightforward once the vulnerable endpoint is identified.

Blast radius

An attacker could seize full administrative control over any organization in the platform, enabling data exfiltration, policy tampering, or service disruption across tenant boundaries.

Detection

Monitor for changes to organization ownership metadata (e.g., 'owner' field updates in organization management API responses) where the requesting user lacks prior administrative rights to that organization; correlate such events with failed authorization attempts in access logs.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.