{"id":"CVE-2026-17066","published":"2026-11-07T05:18:23.787","lastModified":"2026-11-10T19:21:14.897","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 lack proper authorization checks, allowing authenticated attackers to access and modify or delete data belonging to other tenants, leading to confidentiality, integrity, and availability breaches.","exploitability":"Exploitation requires a valid authenticated account with high privileges (PR:H), but no user interaction is needed and the attack can be launched remotely over the network.","blast_radius":"A successful exploit could enable one tenant's compromised account to read, modify, or delete another tenant's data across the platform, potentially affecting all tenants sharing the infrastructure.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which includes fixes for this authorization vulnerability.","detection":"Defenders should monitor for anomalous cross-tenant API access patterns in IBM API Connect audit logs—specifically, requests from a tenant's authenticated session targeting resources (e.g., APIs, organizations, catalogs) belonging to a different tenant—and correlate with user activity logs to identify privilege escalation or lateral movement attempts.","tags":["missing-authorisation","multi-tenant","api-gateway","cwe-862","ibm"],"model":"garnet-coder","analyzedAt":"2026-11-07T10:03:20.352Z"}}