Authorization Flaw in IBM API Connect Affects Data Privacy
CVE-2026-18689

4.3MEDIUM

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
7 November 2026

What is CVE-2026-18689?

An authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allows authenticated users to access unauthorized data. Specifically, it accepts tokens issued for limited purposes, thereby revealing the names of other organizations. This flaw poses a significant risk to data privacy and highlights the importance of stringent access controls within the application.

Affected Version(s)

API Connect 12.1.0.0 <= 12.1.1.2

API Connect 10.0.8.0 <= 10.0.8.12

References

https://www.ibm.com/support/pages/node/7295635
vendor-advisorypatch
https://www.ibm.com/support/pages/node/7295637
vendor-advisorypatch

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.