{"id":"CVE-2026-16920","published":"2026-11-07T05:18:22.990","lastModified":"2026-11-10T20:19:10.580","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in IBM API Connect allows an authenticated low-privileged user to bypass security restrictions by tricking the system into performing unauthorized actions on their behalf.","exploitability":"Exploitation requires valid authentication and low privileges, with no user interaction needed; difficulty is moderate due to reliance on internal logic flaws rather than direct input manipulation.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality, integrity, and availability across the API management platform, potentially affecting downstream services and data.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which contains the official fix for this confused deputy issue (CWE-441).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["confused-deputy","auth-bypass","api-management","cwe441"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:44:05.481Z"}}