Cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*

A broken object-level authorization vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information by bypassing authorization controls.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw, allowing a remote authenticated attacker to access sensitive information.

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a Broken Object Level Authorization flaw allowing remote authenticated attackers to modify arbitrary user profile data.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF) during the import of service definitions, allowing an authenticated attacker to access unauthorized internal resources.

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization (BOLA) vulnerability allowing authenticated attackers to access sensitive data of other tenants.

A SQL injection vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information, carrying a CVSS base score of 9.6.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that permits a remote authenticated attacker to perform unauthorized access or deletion of resources belonging to other tenants.

IBM API Connect contains a critical authentication bypass vulnerability (CVE-2026-17301) due to improper cryptographic signature verification, allowing unauthenticated attackers to gain unauthorized access.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote authenticated attackers to execute arbitrary code and access other tenants due to insufficient validation of custom module uploads.

IBM API Connect versions 10.0.8.x and 12.1.x contain a path traversal vulnerability (CVE-2026-17147) that allows an authenticated remote attacker to achieve arbitrary code execution and unauthorized administrative access.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken access control vulnerability that allows a remote authenticated attacker to access, modify, or delete data across tenants.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an authorization bypass allowing remote authenticated attackers to access sensitive information and modify arbitrary documents.