IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper validation of external references during schema validation. The flaw allows a remote authenticated attacker to trigger server‑side requests to arbitrary external resources, potentially exposing sensitive data that the server should not access. The weakness is classified as Server‑Side Request Forgery (CWE‑918).

The vulnerability affects IBM API Connect, specifically the 10.0.8.x series up to 10.0.8.12 and the 12.1.x series up to 12.1.1.2. Users of these product versions are impacted.

The CVSS Base score of 7.7 labels the flaw as high severity. Although no EPSS score is available, the lack of listing in the CISA KEV catalog suggests there have been no widespread exploitation reports yet. The attack vector is remote; an attacker must be authenticated to the API Connect instance to trigger the vulnerable schema validation. If successful, the attacker can retrieve content from external sources that should remain inaccessible, resulting in confidential data exposure.