IBM API Connect is vulnerable to a broken object‑level authorization flaw that allows a remote authenticated attacker to access sensitive information belonging to other tenants. The weakness is a type of authorization bypass, permitting the attacker to read data that should be isolated to another tenant. This lead to significant confidentiality loss for all tenants that can be abused by an attacker with valid credentials for any tenant.

Affected versions are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability is present in the IBM:API Connect product line and applies to all installations of the listed versions regardless of specific configuration.

The CVSS score is 7.7, reflecting a high risk to confidentiality. No EPSS score is currently available, and the insecurity is not listed in the CISA KEV catalog, indicating no confirmed exploitation in the wild yet. Nonetheless, the flaw requires only that the attacker authenticate against the system and possess valid tenant credentials, making the attack path relatively simple over remote networks. Organizations should treat this as a high‑severity risk and expedite remediation.