IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a weakness that allows a remote authenticated attacker to bypass object-level authorization checks and retrieve sensitive data. This flaw results in a disclosure vulnerability, enabling the compromise of confidential information that should otherwise be protected by the system’s access controls.

Affected products include IBM API Connect 10.x series up to 10.0.8.12 and 12.x series up to 12.1.1.2. These installations are vulnerable unless the versions are upgraded to at least 10.0.8.13 or 12.1.1.3, which incorporate the vendor’s fix.

The CVSS v3 score of 7.7 indicates moderate‑to‑high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not yet actively exploited in the wild. Exploitation requires that the attacker obtain authenticated credentials to the API Connect environment, after which the broken authorization logic can be leveraged to read protected resources. The risk is therefore significant for systems that expose sensitive data and have users with elevated privileges.