IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a broken object-level authorization check that allows any authenticated user to alter other users’ profile information. The access controls do not verify that the acting user has the right to change the target profile, enabling an attacker who has legitimate credentials to modify sensitive account data. This vulnerability is classified as CWE-639 (Authorization Bypass Through User- controlled Key).

Affected components include the IBM API Connect product in the following releases: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The issue was fixed in version 10.0.8.13 and 12.1.1.3 of the product. IBM recommends all customers with these versions to upgrade immediately to the corrected releases.

The CVSS base score of 8.5 indicates high severity, with the primary impact of unauthorized modification. Potential privilege escalation is inferred from the ability to alter user profiles, although the description does not explicitly state this. The EPSS score is not available, and the vulnerability does not appear in CISA’s KEV catalog. Because the attack requires authentication, the attacker must first obtain valid user credentials or compromise a legitimate account before the authorization bypass can be triggered. Once authenticated, the attacker can target any user profile for modification, potentially escalating privileges or manipulating account properties that could affect access control or auditability.