{"id":"CVE-2026-17388","published":"2026-11-07T05:18:53.253","lastModified":"2026-11-09T14:17:20.400","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a broken object-level authorization vulnerability (CWE-639), allowing an authenticated attacker to access sensitive data belonging to other users or tenants by bypassing intended access controls. This is a classic horizontal or vertical privilege escalation via IDOR.","exploitability":"Exploitation requires valid authentication and low skill, as it typically involves manipulating resource identifiers (e.g., IDs in URLs or API requests) without needing complex payloads or conditions.","blast_radius":"Successful exploitation could expose sensitive tenant or user data, compromise confidentiality of multi-tenant configurations, and undermine trust in the API gateway’s isolation guarantees.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 (or later), as these versions include fixes for CVE-2026-17388.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["idor","auth-bypass","api-security","ibm","cwe639"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:52:00.993Z"}}