IBM API Connect: Broken Object Level Authorization (CVE-2026-16715)
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization flaw that allows authenticated attackers to access data from other tenants.
CVE search metadata
CVE search record: CVE-2026-16715. Severity: high. CVSS: 7.7. KEV: no. Product: API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Broken Object Level Authorization (CVE-2026-16715). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 06:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
IBM API Connect contains a broken object-level authorization (BOLA) vulnerability. An authenticated attacker can exploit this flaw to retrieve sensitive information belonging to other tenants in a multi-tenant environment. This issue affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.
Impact
Successful exploitation allows for unauthorized cross-tenant data access, potentially exposing sensitive API configuration or data protected by the gateway.
Recommendation
- Identify and inventory all IBM API Connect instances within the environment.
- Review vendor security bulletins for IBM API Connect to identify the specific patch or upgrade path for the affected 10.x and 12.x versions.
- Apply security updates immediately once released by IBM.
- Audit API access logs to identify suspicious patterns of unauthorized object access (e.g., a single authenticated user accessing multiple distinct tenant IDs).
Immediate actions
Inventory IBM API Connect deployments and prepare for version upgrade to address CVE-2026-16715
Threat Hunt
Identify authenticated API requests showing an account identifier accessing resources associated with different Tenant IDs in a single session
Data: API Connect access/audit logs, Gateway transaction logs