The vulnerability allows a remote authenticated attacker to obtain sensitive information because the system performs improper authorization checks, resulting in a confidentiality breach where data not intended for the attacker’s role can be read. The weakness is classified as CWE-639 (Authorization Bypass Through User‑Controlled Key). No code execution or denial of service is described.

IBM API Connect is affected. Versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable. The fix involves upgrading to 10.0.8.13 or 12.1.1.3, depending on the current release family.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so the current likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and requires an authenticated session; therefore an attacker must first have valid credentials or previously compromise an authenticated user. Once authenticated, the attacker can exploit the lack of proper authorization to read restricted data.