The vulnerability in IBM API Connect allows a remote authenticated attacker to perform unauthorized operations in other tenants’ environments. Improper validation of client‑supplied information fails to verify tenant context, enabling actions on resources that belong to a different tenant. This deficiency can be exploited by an attacker who has legitimate credentials in one tenant but wants to affect another tenant’s data or services.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. These are deployments of the IBM API Connect product from IBM and include any instance running the specified versions.

The CVSS score of 7.1 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exploitation probability cannot be quantified from publicly available data. The likely attack vector is a remote authenticated attacker who can rely on valid credentials within one tenant to target resources in another tenant due to the missing tenant‑context validation.