IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a flaw that allows a remote authenticated attacker to bypass object‑level authorization checks and access sensitive data. The vulnerability is limited to scenarios where the attacker is already authenticated to the platform, but once authenticated it grants read access to all objects the attacker is not intended to view, potentially exposing confidential configuration or user data.

IBM API Connect 12.1.0.0 and 12.1.1.2 are affected. The issue is present in all builds listed in the vendor’s CPE entries and affects systems running these versions of the API management platform.

The CVSS score of 7.7 indicates a high severity level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that exploitation is not widely reported. The attack vector is remote and requires authenticated access, which is common for operators of the API Connect environment. Once authenticated, an attacker may exploit the broken authorization to read any protected resource, leading to significant data exposure.