IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a flaw that allows a remote authenticated attacker to obtain sensitive information by sending improperly validated URLs. The vulnerability is rooted in insufficient sanitization of user‑supplied URL parameters, enabling attackers to craft requests that reveal confidential data or system details. As a result, attackers who have valid credentials can exploit this weakness to read data that should be protected.

The affected product is IBM API Connect, specifically versions 12.1.0.0 to 12.1.1.2. These release numbers are listed in the Common Platform Enumeration strings for the product, and the vulnerability is identified by IBM’s advisories for those versions.

The CVSS score of 8.5 indicates a high severity CVE. The EPSS score is presently not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the API Connect instance, but once authenticated they can send malicious URLs to trigger the information disclosure. The lack of an official workaround means the only reliable protection is to upgrade to the patched release, IBM 12.1.1.3, following IBM’s guidance.