IBM API Connect: Insecure direct object reference (CVE-2026-17320)
IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw, allowing a remote authenticated attacker to access sensitive information.
CVE search metadata
CVE search record: CVE-2026-17320. Severity: high. CVSS: 7.7. KEV: no. Product: API Connect (12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Insecure direct object reference (CVE-2026-17320). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-idor-88459b41/
Triage facts
Revision 1- Applicability
- API Connect (12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 06:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-17320. This vulnerability allows a remote authenticated attacker to access sensitive information by manipulating direct object references within the application. No patch availability or remediation steps are explicitly detailed in the current NVD advisory.
Impact
Successful exploitation allows a remote authenticated attacker to bypass authorization controls and retrieve sensitive information, leading to unauthorized data exposure.
Recommendation
- Inventory all instances of IBM API Connect within the environment to identify systems running versions 12.1.0.0 through 12.1.1.2.
- Monitor vendor security portals for the release of security patches or configuration guidance to mitigate CVE-2026-17320.
- Audit API access logs for anomalous patterns where authenticated users request resources outside their typical scope or ID ranges.
Immediate actions
Inventory IBM API Connect deployments to identify vulnerable versions.
Threat Hunt
Identify authenticated API requests indicating IDOR-style resource enumeration
Data: API Access Logs, HTTP status codes, Request parameters / URI structure
Mitigations
Monitor IBM Security Advisories for patch release.
CVE-2026-17320