IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an LDAP injection flaw that allows a remote attacker to inject LDAP query data and bypass the security restrictions configured for the service. This vulnerability is categorized as CWE‑90 and can lead to unauthorized data exposure or privilege escalation by enabling the attacker to read or modify protected information without proper authentication.

Affected systems are IBM API Connect deployments running any of the following versions: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

The CVSS base score of 4.8 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a remotely crafted LDAP query sent over the network, so the risk remains for systems exposed to untrusted traffic.