IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that lets a remote authenticated attacker send arbitrary requests to internal or external endpoints. This vulnerability can result in the disclosure of confidential data that the application can access over the network, directly impacting the confidentiality of the system.

IBM API Connect 12.1.0.0 up to and including 12.1.1.2 are vulnerable. The affected product is IBM API Connect, and the issue applies to every instance running any of those versions.

The CVSS score of 5.8 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote but requires an attacker to be authenticated; therefore, a successful exploitation depends on obtaining valid credentials and, once authenticated, the attacker can direct the server to contact arbitrary resources, potentially leaking sensitive information.