IBM API Connect: Broken Object Level Authorization (CVE-2026-17293)
IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a Broken Object Level Authorization flaw allowing remote authenticated attackers to modify arbitrary user profile data.
CVE search metadata
CVE search record: CVE-2026-17293. KEV: no. Product: API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Broken Object Level Authorization (CVE-2026-17293). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-c7274648/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 06:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability, tracked as CVE-2026-17293. The vulnerability exists because the application fails to perform adequate authorization checks when processing requests to modify user profile information. A remote authenticated attacker can manipulate API calls to target and alter profiles belonging to other users.
Impact
Successful exploitation allows a remote authenticated attacker to modify user profile data without proper authorization.
Recommendation
- Audit internal API logs to identify any unauthorized attempts to access or modify user profile objects.
- Review IBM security bulletins for official patches or configuration mitigations.
- Apply the vendor-provided security updates to IBM API Connect immediately upon availability.
Immediate actions
Inventory IBM API Connect deployments and compare against vulnerable version ranges.
Threat Hunt
Identify abnormal frequency or target variance in user profile update API requests from authenticated accounts.
Data: API access logs, User authentication context