CVE-2026-17338

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 suffer from broken object-level authorization, allowing an authenticated attacker with low privileges to access sensitive data they should not be authorized to view. This is a classic CWE-639 flaw where access controls rely on user identity but fail to verify ownership or permission for specific resources.

Exploitability

Exploitation requires valid authentication and low-privilege access, with no complex conditions or user interaction needed; it is straightforward for an authenticated insider or compromised credential holder.

Blast radius

Successful exploitation could lead to unauthorized exposure of sensitive tenant or customer data stored or processed by API Connect, potentially affecting multiple customers in multi-tenant deployments.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for this authorization flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.