The vulnerability is a server‑side request forgery (CWE‑918) that can let a remote authenticated attacker direct the API Connect server to issue arbitrary HTTP requests against internal resources, exposing sensitive data that should not be reachable from the internet. The likely attack vector requires the attacker to be authenticated to the API Connect instance and then issue a crafted request that triggers the SSRF. This inference comes from the description that a remote authenticated attacker can obtain sensitive information via SSRF, indicating that the flaw operates only when proper credentials are presented, but the actual SSRF mechanism is not described in detail.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are impacted. The issue stems from SSRF code present in those releases; later releases beyond 10.0.8.12 and 12.1.1.2 are not affected.

The CVSS score of 6.4 marks medium severity. The EPSS score is not available, so a quantified likelihood of exploitation is missing, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the exploitation requires remote authenticated access to an API Connect instance, after which the attacker can construct a request that forces the server to contact an internal target. As the flaw is server‑side, no further preconditions are stated, making the attack straightforward once credentials are obtained.