An attacker who is authenticated to IBM API Connect can provide client‑supplied information that is not adequately verified, allowing the attacker to impersonate another party. The vulnerability can be leveraged to bypass security restrictions and gain unauthorized access to protected resources or actions. The documented CVSS score of 8.5 indicates a high‑severity flaw. The description indicates the flaw is remote and requires authentication to be exercised, meaning the attacker must first log in before the exploit can succeed.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. IBM recommends updating to the latest release, specifically v12.1.1.3 for the 12.x line or 10.0.8.13 for the 10.x line, to remediate the issue.

The CVSS score of 8.5 signals a high vulnerability, but the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting the overall exploitation likelihood is not yet confirmed. Nevertheless, because the flaw permits impersonation once an attacker gains account credentials, the potential impact on confidentiality, integrity, and availability is significant. The attack vector is remote authenticated, with prerequisites including a valid authenticated session to the API Connect environment. If exploited, an attacker could impersonate a legitimate user and perform actions or access data they would otherwise be denied.