IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authentication flaw that can allow an attacker who is already authenticated to gain elevated privileges. This flaw enables the attacker to bypass intended authorization controls, potentially accessing or modifying data and configuration that should be restricted, thereby compromising confidentiality, integrity, and availability of the API Connect environment.

The affected products are IBM API Connect. Versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to the described privilege escalation.

The vulnerability has a CVSS score of 9.9, reflecting a high severity. The EPSS score is not available, but the lack of a KEV listing does not reduce the risk; the flaw can be exploited by any remote party that already has authenticated access, allowing immediate privilege escalation within the affected systems. The likely attack vector is a remote authenticated user taking advantage of the authentication weakness to elevate their privileges.