IBM API Connect 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that enables a remote authenticated attacker to supply an arbitrary URL. The improper validation of the supplied URL allows the attacker to create requests to internal network services that are normally inaccessible from the outside, thereby enabling discovery of internal infrastructure. The primary impact of this vulnerability is internal network reconnaissance and enumeration; the flaw is classified as CWE‑918.

Vulnerable versions are IBM API Connect 12.1.0.0 and 12.1.1.2. IBM recommends upgrading to the fixed release 12.1.1.3 or later to remediate the flaw.

The CVSS score of 5.0 indicates moderate severity. The flaw requires valid authentication against API Connect, so the likelihood of exploitation depends on the strength of user credentials and the presence of privileged accounts. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so the current probability of exploitation is unknown. Based on the description, it is inferred that an attacker would use the API’s URL‑accepting endpoints to send crafted request payloads, performing typical SSRF techniques to probe backend services.