IBM API Connect CVE-2026-17049

Exploitation requires a valid authenticated session on the IBM API Connect instance (PR:L) - any low-privilege account is sufficient; it is not pre-authentication. The core prerequisite is the authorization-bypass-through-user-controlled-key flaw: the attacker manipulates a key or identifier they already supply in requests to reference documents they do not own. Limiting factors: an attacker must first hold or obtain credentials for the instance, and only versions 12.1.0.0 through 12.1.1.2 are affected. No special non-default configuration or user interaction is required, which keeps realistic risk high for any multi-tenant or multi-user deployment.

This is a genuine high-priority issue, not an inflated high-CVSS score. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low attack complexity, requiring only low-privilege authentication, no user interaction, with a scope change and high confidentiality and integrity impact. CWE-639 (Authorization Bypass Through User-Controlled Key) is a classic IDOR pattern in which any authenticated user can reference objects belonging to others by manipulating a key, which aligns with the PR:L and S:C metrics and with the description's claim of obtaining sensitive information and modifying arbitrary documents. The vuln.today decision label is act_now and IBM has shipped a patch, reinforcing urgency. Signals are largely consistent, but note the gaps: there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation yet - the urgency here derives from severity and ease of exploitation (any valid account suffices), not from confirmed in-the-wild activity. The A:H (availability) metric assigned by IBM is not substantiated by the description, which describes only disclosure and modification, not denial of service - treat the availability impact as unverified.

A low-privileged authenticated user of an IBM API Connect instance (12.1.0.0 through 12.1.1.2) alters a user-controlled identifier in an API request to reference documents owned by other tenants or users. Because the server does not verify that the caller is authorized for the referenced key, the attacker reads sensitive data and modifies arbitrary documents belonging to others. No public exploit identified at time of analysis; exploitation requires only a valid account and request manipulation.