IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to alter internal requests because the system does not neutralize argument delimiters correctly. By supplying special characters in user data, an attacker can inject additional parameters into requests sent by the server, potentially leading to undesired API behaviour or privilege escalation. The vulnerability is limited to users who have valid authentication credentials within the system, so it does not enable unauthenticated exploitation.

The affected product is IBM API Connect. Vulnerable releases include version 10.0.8.0 up to 10.0.8.12 and version 12.1.0.0 up to 12.1.1.2. The fix is available in the most recent releases, v12.1.1.3 and the 10.0.8.13 maintenance release.

The CVSS score of 2.7 indicates a low impact severity. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that the attacker already possess legitimate credentials, meaning an attacker must compromise or obtain valid authentication before attempting the request tampering. Because the exploitation surface is relatively narrow and there is no evidence of active exploitation, the overall risk to organizations remains low, but it is still advisable to address the issue promptly.