REST API Origin Verification Flaw in IBM Aspera Connect
CVE-2026-120115

6.3MEDIUM

Key Information:

Vendor

IBM
Status
Aspera Connect
Vendor
CVE Published:
8 November 2026

What is CVE-2026-120115?

IBM Aspera Connect versions 1.6.1 through 4.2.19 have a security issue due to inconsistent enforcement of origin verification across all REST API endpoints. This flaw allows an attacker to exploit social engineering tactics, convincing users to visit malicious websites. Once a victim is directed to the unauthorized site, the attacker may be able to delete or inspect sensitive account configurations, leading to potential unauthorized access and data leakage.

Affected Version(s)

Aspera Connect 1.6.1 <= 4.2.19

References

https://www.ibm.com/support/pages/node/7295714
vendor-advisorypatch

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.