{"id":"CVE-2026-17049","published":"2026-11-07T05:18:23.173","lastModified":"2026-11-10T19:21:14.777","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-639"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability (CWE-639) where an authenticated attacker can leverage user-controlled keys to access unauthorized resources and modify arbitrary documents, leading to confidentiality, integrity, and availability impacts.","exploitability":"Exploitation requires a low-privileged authenticated account and no user interaction; the attacker must supply a manipulated key to bypass intended authorization checks.","blast_radius":"Successful exploitation could allow an attacker to exfiltrate sensitive configuration or tenant data, tamper with API policies or gateway rules, and potentially disrupt service availability across multiple tenants in shared environments.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, as this version includes the fix for CVE-2026-17049.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","cwe639","api-gateway","ibm","sensitive-data-exposure"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:44:14.847Z"}}