IBM API Connect instances in the affected ranges allow a remote authenticated attacker to obtain sensitive information belonging to other organizations because authorization checks are omitted when certain organization URLs are resolved. The flaw is a classic authorization bypass, classified as CWE‑639, and can lead to a confidentiality breach with moderate severity. The CVSS score of 6.4 reflects the potential for unauthorized data disclosure but limits the impact to information rather than system compromise.

The vulnerability applies to IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Users running any of these releases should verify their installation version and ensure they are not operating a vulnerable instance.

The CVSS score of 6.4 indicates moderate risk, and the EPSS score is not available, suggesting no known exploitation traffic yet. The vulnerability is not listed in CISA KEV, and there are no publicly documented exploits. The likely attack vector requires a legitimate authenticated session and the ability to resolve organization URLs; an attacker with these prerequisites can read data from another organization. Given the absence of active exploitation, the risk remains moderate, but the potential impact on confidentiality warrants prompt action.