IBM API Connect 12.1.0.0 through 12.1.1.2 contains an improper authentication flaw that enables a remote attacker to impersonate a trusted party and gain unauthorized read access to sensitive API catalog and runtime configuration data. The vulnerability allows the attacker to exploit insufficient verification of client information, effectively bypassing access controls and compromising confidentiality of configuration artifacts and API definitions.

The affected systems are IBM API Connect installations running versions 12.1.0.0 through 12.1.1.2. These include both the API management portal and the runtime platform that expose catalog and configuration endpoints.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score is not available, so current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; a malicious actor can send crafted requests to API Connect’s management interfaces over the network, taking advantage of the authentication weakness without needing local access or privileged credentials. No additional system prerequisites are listed beyond the presence of a reachable API Connect instance.