IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 suffer from broken object‑level authorization that allows a remote authenticated attacker to read sensitive data belonging to other tenants. The flaw shortens the confidentiality boundary of tenant isolation, making it possible for one tenant to access the internal data of another tenant. This constitutes a serious breach of confidentiality and is classified as CWE‑639, an authorization bypass weakness.

The affected products are IBM API Connect for the 10.x release line and the 12.x release line. Specifically, any deployment running API Connect 10.0.8.0 up to and including 10.0.8.12, or API Connect 12.1.0.0 up to and including 12.1.1.2, is vulnerable and requires remediation.

The vulnerability is rated CVSS 7.7, indicating high severity. EPSS data is not available, so exploitation likelihood cannot be quantified; however, the flaw requires only authenticated access to the platform, which many tenants possess. The issue is not listed in the CISA KEV catalog. Because the flaw permits cross‑tenant data exposure, its impact is widespread within any affected deployment and poses an immediate risk to confidentiality if exploited.