The vulnerability exploits an authorization bypass involving user‑controlled keys in IBM API Connect 12.1.x. A remote authenticated user can craft a key to gain unauthorized access to protected documents, allowing them to read confidential information and alter arbitrary files, thereby compromising data integrity and confidentiality.

Affected products include IBM API Connect versions 12.1.0.0 through 12.1.1.2 across all supported environments. Users running these builds should verify the installed version and apply remediation steps.

The CVSS score of 9.9 indicates a critical severity. Attackers need only valid credentials and can exploit the system via normal API calls using user‑controlled keys. Although EPSS is not available and the issue is not listed in CISA KEV, the high severity and authentication requirement suggest a substantial risk if the vulnerability remains unpatched.