IBM API Connect is affected by an improper case handling flaw that allows a remote authenticated attacker to bypass security restrictions and send unauthorized emails by exploiting inconsistently applied access controls. The vulnerability arises from the software’s failure to enforce case sensitivity on input parameters, enabling bypass of the intended access restrictions and potentially allowing the attacker to perform additional privileged actions. The impact is confined to authorized users who possess valid credentials, and the attacker can leverage the flaw to send emails or otherwise manipulate functions that should be restricted.

Vulnerable versions include IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. These releases are specified by IBM through the same product identifiers and are affected by the case‑insensitivity flaw.

The CVSS score of 4.1 indicates a moderate severity level, and the lack of an EPSS score and absence from the CISA KEV catalog suggest that widespread exploitation is not yet documented. Nevertheless, the attack requires valid authentication, so it is most likely to be used by attackers who have compromised legitimate user credentials or gained initial access to the system. The vulnerability’s trigger is remote, but it is limited to authenticated users, and currently no publicly disclosed exploits are known.