IBM API Connect: Broken object-level authorization (CVE-2026-17283)
A broken object-level authorization vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information by bypassing authorization controls.
CVE search metadata
CVE search record: CVE-2026-17283. Severity: high. CVSS: 7.7. KEV: no. Product: API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Broken object-level authorization (CVE-2026-17283). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-576fa7e8/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 07:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization (BOLA) flaw. This vulnerability enables a remote authenticated attacker to interact with unauthorized objects and retrieve sensitive information. No exploitation details or patch availability dates beyond the advisory notification are disclosed at this time.
Impact
Successful exploitation allows an authenticated attacker to bypass authorization mechanisms, leading to unauthorized disclosure of sensitive data managed by the API Connect platform.
Recommendation
- Inventory all deployed instances of IBM API Connect.
- Monitor vendor release channels for the issuance of security patches addressing CVE-2026-17283.
- Review API access logs for anomalous patterns where authenticated users request identifiers outside their standard scope or expected resource patterns.
Immediate actions
Inventory IBM API Connect instances and monitor for vendor patches.
Threat Hunt
Identify authenticated API users requesting sequential or anomalous object IDs.
Data: API Access Logs, Gateway Transaction Logs
Mitigations
Apply security patches for CVE-2026-17283 upon release.
CVE-2026-17283