IBM API Connect products from version 10.0.8.0 through 10.0.8.12 and from 12.1.0.0 through 12.1.1.2 contain an improper validation of user‑supplied URLs that can be exploited by an authenticated user to force the server to contact internal network services, thereby revealing information about those services. The flaw does not allow execution of arbitrary code, but it enables the attacker to enumerate internal resources and potentially gather sensitive configuration details. The weakness is a classic instance of inadequate path or URL validation (CWE-918).

The affected products are IBM API Connect, specifically the 10.0.8 series up to 10.0.8.12 and the 12.1 series up to 12.1.1.2. These versions are listed in the Common Platform Enumeration (CPE) strings and are the subject of the IBM advisory. Users running any of these releases should treat them as at risk until updated.

The CVSS score for this vulnerability is 6.4, indicating a moderate level of severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. The likely attack scenario requires authenticated access to the API Connect instance; the attacker supplies a crafted URL that causes the server to reach internal services, revealing information. Because the flaw is remote and relies on authenticated access, it could be leveraged in targeted attack campaigns. The risk remains moderate but should be mitigated promptly as recommended by IBM.