{"id":"CVE-2026-19121","published":"2026-11-07T05:18:59.963","lastModified":"2026-11-07T05:19:00.093","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 suffer from improper authorization where an authenticated user can bypass tenant isolation by accessing resources belonging to another tenant due to insufficient verification of tenant context against the authenticated user's identity. This allows unauthorized access to sensitive data and operations across tenants.","exploitability":"Exploitation requires valid authentication and knowledge of another tenant's resource identifiers; no public exploit exists, but the low attack complexity (AV:N, AC:L) suggests it is feasible for a privileged insider or compromised account.","blast_radius":"Successful exploitation enables cross-tenant data access and modification, potentially leading to full compromise of tenant confidentiality and integrity within the same API Connect deployment.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which includes fixes for improper authorization in the tenant context validation logic.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","tenant-isolation-failure","cwe-290","ibm","api-connect"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:55:54.687Z"}}