This vulnerability is an insecure direct object reference found in IBM API Connect versions 12.1.0.0 through 12.1.1.2. A remote attacker who can authenticate to the system can use the direct object reference to access or manipulate resources that should be protected, resulting in the disclosure of sensitive information and the possibility of denying service to legitimate users. The weakness is categorized as CWE‑639.

The affected systems are IBM API Connect 12.1.0.0 and 12.1.1.2, as identified by the IBM CNA. No other vendors or products are listed.

The CVSS score is 7.6, indicating a high risk to confidentiality and availability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated attacker who can create or manipulate requests that reference protected objects. Successful exploitation requires valid credentials, so the threat is limited to authenticated users who have been granted access to the API Connect deployment. Nonetheless, the combination of data exposure and potential denial of service creates a significant risk for organizations using the vulnerable versions.