IBM API Connect: Broken object-level authorization (CVE-2026-17292)
IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization vulnerability allowing remote authenticated attackers to seize ownership of unauthorized organizations.
CVE search metadata
CVE search record: CVE-2026-17292. Severity: critical. CVSS: 9.1. KEV: no. Product: API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2). Brief: IBM API Connect: Broken object-level authorization (CVE-2026-17292). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-brola/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
IBM API Connect contains a broken object-level authorization (BOLA) vulnerability (CVE-2026-17292) caused by incomplete access checks on organization objects. A remote authenticated attacker can leverage this flaw to modify the ownership of organizations they do not control, leading to unauthorized privilege escalation and takeover of organizational resources.
Impact
Successful exploitation allows a remote authenticated attacker to gain full administrative control over target organizations, potentially resulting in unauthorized access to sensitive API data, configuration modifications, and full resource takeover.
Recommendation
- Inventory all instances of IBM API Connect within the environment to identify versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.
- Prioritize the application of vendor-supplied security patches or version upgrades as documented in official IBM security bulletins for CVE-2026-17292.
- Implement monitoring for administrative configuration changes within API Connect to detect anomalous organization ownership transfers.
Immediate actions
Upgrade IBM API Connect to a patched version as advised by IBM security documentation.
Threat Hunt
Monitor API Connect audit logs for unusual ownership changes of organization objects by low-privileged authenticated users.
Data: API Connect administrative audit logs
Mitigations
Upgrade to non-vulnerable versions of IBM API Connect.
CVE-2026-17292