{"id":"CVE-2026-17293","published":"2026-11-07T05:18:36.570","lastModified":"2026-11-10T16:24:29.400","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","cwes":["CWE-639"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a broken object-level authorization flaw (CWE-639) that allows an authenticated attacker to modify another user's profile information without proper permission checks. This occurs because access controls fail to verify the requesting user is authorized to change the targeted profile.","exploitability":"Exploitation requires valid authentication and knowledge of a target user's profile identifier, but no special privileges beyond standard user access are needed.","blast_radius":"Successful exploitation could enable attackers to escalate privileges by modifying administrative or other users' profiles, potentially compromising data integrity and enabling further attacks.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, where the broken object-level authorization vulnerability has been patched.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","authorization-flaw","api","ibm"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:49:49.147Z"}}