{"id":"CVE-2026-19121","aliases":["EUVD-2026-118796","GHSA-52fx-vpx9-gc53"],"status":"published","title":"Multiple Vulnerabilities in IBM API Connect","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00374,"percentile":0.31642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2026-11-07T04:34:41Z","modified":"2026-11-07T06:31:24Z","products":[{"vendor":"ibm","product":"api connect"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19121"},{"url":"https://github.com/advisories/GHSA-52fx-vpx9-gc53"}],"sources":{"cve":[{"id":"CVE-2026-19121","title":"Multiple Vulnerabilities in IBM API Connect","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.","status":"published","published":"2026-11-07T04:34:41.297Z","modified":"2026-11-07T04:34:41.297Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-07T05:32:42.683254Z"}],"euvd":[{"id":"EUVD-2026-118796","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.","status":"published","published":"2026-11-07T04:34:41Z","modified":"2026-11-07T04:34:41Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-07T09:08:55.005824Z"}],"ghsa":[{"id":"GHSA-52fx-vpx9-gc53","title":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain...","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.","status":"published","published":"2026-11-07T06:31:23Z","modified":"2026-11-07T06:31:24Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-07T06:36:01.089885Z"}],"nvd":[{"id":"CVE-2026-19121","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.","status":"published","published":"2026-11-07T05:18:59.963Z","modified":"2026-11-07T05:19:00.093Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-07T07:04:26.376376Z"}]}}