CVE-2026-17293

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a broken object-level authorization flaw (CWE-639) that allows an authenticated attacker to modify another user's profile information without proper permission checks. This occurs because access controls fail to verify the requesting user is authorized to change the targeted profile.

Exploitability

Exploitation requires valid authentication and knowledge of a target user's profile identifier, but no special privileges beyond standard user access are needed.

Blast radius

Successful exploitation could enable attackers to escalate privileges by modifying administrative or other users' profiles, potentially compromising data integrity and enabling further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, where the broken object-level authorization vulnerability has been patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.