Multiple Vulnerabilities in IBM API Connect

IBM API Connect2026-11-07 04:33 UTC1 min readRead in

Summary

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.

Remediation

Inventory every IBM API Connect deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Patchhttps://www.ibm.com/support/pages/node/7295635

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Affected versions

Version	Fixed in
12.1.0.0 – 12.1.1.2	None yet

Weakness

CWE-639

Timeline

2026-11-07Publicly disclosed

Sources

CVE · NVD