IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a path parameter injection flaw that allows a remote authenticated attacker to read sensitive data belonging to other tenants. The omission of proper input validation in the request path enables this data exfiltration, posing a confidentiality breach where attackers can access tenant‑specific information without direct file system or database compromise.

The affected systems are IBM API Connect products from version 10.0.8.0 up to 10.0.8.12 and from 12.1.0.0 up to 12.1.1.2. These include the 10.x and 12.x release lines used by enterprises to expose API services across multiple tenants.

The CVSS score of 6.4 indicates moderate severity, but the exploit probability is not known due to the missing EPSS data, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring authentication to the API gateway, after which an attacker can craft a malicious path that references resources of another tenant. The lack of immediate public exploits reduces the urgency but the ability to harvest confidential data warrants timely remediation.