Broken-Object-Level-Authorization - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/broken-object-level-authorization/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 06:06:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIBM API Connect: Broken Object Level Authorization (CVE-2026-17293)https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-c7274648/Sat, 07 Nov 2026 06:06:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-c7274648/IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a Broken Object Level Authorization flaw allowing remote authenticated attackers to modify arbitrary user profile data.IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability, tracked as CVE-2026-17293. The vulnerability exists because the application fails to perform adequate authorization checks when processing requests to modify user profile information. A remote authenticated attacker can manipulate API calls to target and alter profiles belonging to other users.

Impact

Successful exploitation allows a remote authenticated attacker to modify user profile data without proper authorization.

Recommendation

  • Audit internal API logs to identify any unauthorized attempts to access or modify user profile objects.
  • Review IBM security bulletins for official patches or configuration mitigations.
  • Apply the vendor-provided security updates to IBM API Connect immediately upon availability.
]]>highadvisoryapi-securitybroken-object-level-authorizationbolaweb-application