{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/broken-object-level-authorization/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-17293"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":["api-security","broken-object-level-authorization","bola","web-application"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability, tracked as CVE-2026-17293. The vulnerability exists because the application fails to perform adequate authorization checks when processing requests to modify user profile information. A remote authenticated attacker can manipulate API calls to target and alter profiles belonging to other users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to modify user profile data without proper authorization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit internal API logs to identify any unauthorized attempts to access or modify user profile objects.\u003c/li\u003e\n\u003cli\u003eReview IBM security bulletins for official patches or configuration mitigations.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided security updates to IBM API Connect immediately upon availability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:06:43Z","date_published":"2026-11-07T06:06:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-c7274648/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a Broken Object Level Authorization flaw allowing remote authenticated attackers to modify arbitrary user profile data.","title":"IBM API Connect: Broken Object Level Authorization (CVE-2026-17293)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-c7274648/"}],"language":"en","title":"CraftedSignal Threat Feed - Broken-Object-Level-Authorization","version":"https://jsonfeed.org/version/1.1"}