IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have an input validation flaw. The flaw allows a remote authenticated attacker to send specially crafted request parameters that bypass security restrictions, thereby accessing analytics data that the attacker is not authorized to view. This is a moderate‑severity vulnerability classified under CWE‑235, representing an improper validation of code execution paths or input to a trusted component.

The affected products are IBM API Connect. Vulnerable versions include 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. The official vendor recommendation is to upgrade to the latest patch release v12.1.1.3 or to 10.0.8.13, as listed in the IBM Fix Central release notes.

The CVSS score of 5.4 indicates moderate risk, and the EPSS score is not available, so current exploitation probability cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated attacker sending specially crafted request parameters to an analytics endpoint, as inferred from the description. An attacker would first authenticate to the API Connect environment and then craft a request to an analytics endpoint with malformed parameters that bypass input validation. Because the flaw depends on authenticated access, an internal or compromised user could leverage it to read restricted analytics data.