IBM API Connect software in versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contains a flaw that allows a remote authenticated attacker to invoke error responses that contain detailed information about the underlying system. This excessive information can be leveraged to learn about the application configuration, internal resources and potentially sensitive data, constituting an information disclosure vulnerability (CWE-209). The flaw does not provide direct code execution or privilege escalation capabilities, but the data exposed can aid further attacks if an adversary has existing credentials.

The affected products are IBM API Connect 10.0.8.0, 10.0.8.12, 12.1.0.0 and 12.1.1.2. Publicly available CPE references specify these exact versions, indicating that any instance of API Connect running within the mentioned versions is vulnerable. Users of the 12.1.x branch should be particularly aware that pre‑12.1.1.3 builds are susceptible.

The assessed CVSS score of 4.3 reflects a moderate impact rating, with the vulnerability scoring primarily for a moderate level of information disclosure. EPSS information is unavailable, but the lack of KEV listing indicates no publicly known active exploitation. The attack path requires remote access to API Connect and valid authentication credentials; an attacker would need to log in to trigger error generation and receive the verbose responses. Once authenticated, the attacker can attempt to induce errors that reveal system details; this does not grant further privileges but can facilitate reconnaissance.