IBM DataPower Gateway versions 10.5.0, 10.6.0 and 10.6CD contain an access‑control flaw (CWE‑497) that permits an administrative user to retrieve configuration data and other sensitive system information from domains that the user should not be able to view. This weakness can expose credentials, system settings and other confidential details, thereby compromising the confidentiality of all managed domains.

Affected products include IBM DataPower Gateway 10.5.0 (10.5.0.0 through 10.5.0.20), 10.6.0 (10.6.0.0 through 10.6.0.8) and 10.6CD (10.6CD 10.6.1.0 through 10.6.5.0). The issue is resolved in the following releases: 10.5.0.21, 10.6.0.9, 10.6.1.0, 10.6.5.0 and 10.6.6.0. Detailed upgrade instructions and fix lists are available at https://www.ibm.com/docs/en/datapower-gateway/10.5.0, https://www.ibm.com/docs/en/datapower-gateway/10.6.0 and https://www.ibm.com/docs/en/datapower-gateway/10.6.x.

The CVSS base score of 4.1 indicates moderate severity, while an EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrative authentication or control; attackers would need to log in as an administrator or compromise an existing admin account to leverage the flaw, thereby limiting threat exposure primarily to insiders or accounts later hijacked by external actors.