IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain missing authorization checks that allow a remote authenticated attacker to perform actions for which they lack permission, such as deleting other users’ API keys and accessing sensitive information. This flaw can be exploited by any user who has legitimate credentials within the system, making an attacker’s existing privileges sufficient to abuse the vulnerability.

All deployments of IBM API Connect 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 are affected. These versions can be found under IBM:API Connect in product listings and are identified by the CPE strings for those release ranges.

The CVSS score of 7.4 classifies the flaw as high severity. The exploit requires only remote authentication, so any user with valid credentials can leverage the missing authorization checks. The vulnerability is not listed in the CISA KEV catalog and the EPSS score is unavailable, but the risk remains significant due to the potential impact on confidential data and key management.