IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that permits a remote authenticated attacker to bypass object-level authorization checks. The result is the disclosure of sensitive data not intended for that user, compromising confidentiality. This weakness is classified as CWE-639, indicating misuse of access control. The attacker must first authenticate to the API layer; after bypassing the ownership checks, the attacker can read data belonging to other users or components.

Affected deployments include IBM API Connect on any version from 10.0.8.0 through 10.0.8.12 or from 12.1.0.0 through 12.1.1.2. The products were identified by the CNAs as IBM API Connect, with the affected releases listed in the provided CPES list. No vendors other than IBM are listed.

The CVSS base score of 7.7 indicates a high impact and moderate exploitation complexity. EPSS data is not available; KEV listing is not present. The vulnerability requires the attacker to possess valid credentials to the API layer; after authentication, the bypass of the object-level checks allows data extraction. The likelihood of exploitation depends on network exposure and credential strength, and is potentially significant where API endpoints are publicly reachable or internal network access is not tightly restricted.