IBM API Connect versions through 10.0.8.12 and 12.1.1.2 allow a remote authenticated user to submit definitions that include external references. The system does not properly restrict which external resources can be fetched or passed back, enabling the attacker to read local files or trigger outbound requests to arbitrary hosts. This results in confidentiality breaches and potential unauthorized network access from the API Connect server.

Vendors affected include IBM for the API Connect product. The specific vulnerable releases are API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

The vulnerability scores a CVSS of 9.6, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but the high CVSS coupled with the requirement for authenticated access means that organizations using the affected versions should treat it as a critical risk. An attacker would typically log in to the API Connect management interface and submit a definition containing carefully crafted external references to gain the described capabilities.