IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a missing authorization flaw that enables a remotely‑authenticated attacker to read, modify, or delete data belonging to other tenant accounts. Because the system fails to enforce proper tenant boundaries, sensitive information and data integrity are at risk. This flaw, identified as CWE‑862, represents a failure to verify user permissions before accessing resources and can lead to significant confidentiality, integrity, and availability violations if exploited.

The affected product is IBM API Connect, specifically versions 12.1.0.0 and 12.1.1.2. These versions are deployed by organizations using IBM’s API management platform and the missing authorization flaw can affect any tenant configured within those releases. No other IBM products are listed as impacted in the CNA data.

The vulnerability scores high with a CVSS of 9.1, indicating critical severity. EPSS is not provided, and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been actively exploited, but the lack of detection does not reduce risk. The attack requires the attacker to be authenticated, so privileged credentials or compromised accounts are needed. Once authenticated, the attacker can masquerade as any tenant and gain full access to other tenants’ data, making the exploitation path straightforward on normal deployments. Therefore, the risk is significant if the environment lacks tenant isolation controls.