IBM API Connect 10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2 Auth Token Bypass Info Leak
CVE-2026-18689 Published on November 7, 2026
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
Vulnerability Analysis
CVE-2026-18689 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-18689 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-18689
Want to know whenever a new CVE is published for IBM Api Connect? stack.watch will email you.
Affected Versions
IBM API Connect:- Version 12.1.0.0, <= 12.1.1.2 is affected.
- Version 10.0.8.0, <= 10.0.8.12 is affected.