A critical (CVSS 9.9) authorization bypass in IBM API Connect 12.1.0.0 through 12.1.1.2 could let a remote, authenticated attacker read sensitive information and modify arbitrary documents.
What Is It
CVE-2026-17049 is an authorization bypass through user-controlled keys (CWE-639) in IBM API Connect. IBM's description says a remote authenticated attacker could exploit the flaw to "obtain sensitive information and modify arbitrary documents." Flaws in this class usually happen when an application trusts an identifier supplied by the user and doesn't check that the requester is allowed to access the object it points to.
IBM PSIRT published the record to NVD on 2026-11-07. NVD lists it as "Awaiting Analysis," so NVD has not yet added its own enrichment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable: the attacker does not need local access.
- Low complexity: no special conditions are needed to exploit it.
- Low privileges: any authenticated account is enough, not an administrator.
- No user interaction: no victim has to click or open anything.
- Scope changed: the impact can reach resources beyond the vulnerable component.
- High impact: confidentiality, integrity and availability are all rated high.
API Connect is an API management platform, so it often sits in front of many back-end services. If a low-privileged user can read and modify documents across authorization boundaries, that is a serious risk on any multi-tenant or widely provisioned deployment.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. Active exploitation is not confirmed by KEV at this time, and no CISA-mandated remediation deadline applies.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The supplied data lists no other products or version branches.
Patch Status
The NVD record does not give a fixed version or specific remediation steps. IBM's security bulletin (linked below) is the authoritative source for fixes, interim fixes and mitigations. Organizations running API Connect 12.1.0.0–12.1.1.2 should:
- review the IBM advisory now and apply the remediation it recommends;
- because any authenticated user could exploit the flaw, audit who holds accounts on affected instances until they are patched.
Because the CVE is not in KEV, CISA has issued no required action or federal due date.
Sources
- NVD, CVE-2026-17049
- IBM Security Bulletin (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)