Cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*

A broken object-level authorization vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information by bypassing authorization controls.

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a Broken Object Level Authorization flaw allowing remote authenticated attackers to modify arbitrary user profile data.

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization (BOLA) vulnerability allowing authenticated attackers to access sensitive data of other tenants.

A SQL injection vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information, carrying a CVSS base score of 9.6.

IBM API Connect contains a critical authentication bypass vulnerability (CVE-2026-17301) due to improper cryptographic signature verification, allowing unauthenticated attackers to gain unauthorized access.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote authenticated attackers to execute arbitrary code and access other tenants due to insufficient validation of custom module uploads.

IBM API Connect versions 10.0.8.x and 12.1.x contain a path traversal vulnerability (CVE-2026-17147) that allows an authenticated remote attacker to achieve arbitrary code execution and unauthorized administrative access.